2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A user behavior alert indicates that a user is accessing a sensitive HR system from a new device. The user recently changed roles and now works in the HR department. What is the most important context to consider when evaluating this alert?

   • AThe alert is malicious because the user is accessing a system they have never accessed before.
   • BThe user's new role requires access to the HR system, and the new device may be a company-issued device.
   • CThe alert is a false positive because the user is an employee.
   • DThe alert should be escalated because new device access is always a security risk.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A user behavior alert flags a user who is accessing a database at 2:00 AM. The user is a database administrator who regularly performs maintenance during off-hours. What should the analyst consider when determining if this alert is benign?

   • AThe alert is a false positive because the user has legitimate access.
   • BThe alert is automatically malicious because it is outside normal business hours.
   • CThe alert should be escalated because any off-hours access is suspicious.
   • DThe user's role and baseline behavior, which include off-hours maintenance.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A user behavior alert flags that a senior engineer has accessed a source code repository from a new device at 1 AM. The engineer is on-call and has a history of occasional late-night work. The new device is not registered in the company's device management system. The engineer's account has MFA enabled, and the login succeeded. You have limited SOC staff and must decide the next action. What should you do?

   • ATreat the alert as a false positive because the engineer is on-call and MFA succeeded.
   • BInvestigate the device and verify with the engineer before taking any action.
   • CEscalate the alert to the incident response team immediately because of the unregistered device.
   • DDisable the engineer's account and require re-registration of the device.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A user behavior alert fires when an employee logs in from a new geographic location at 3:00 AM and then attempts to access a sensitive database that the employee has never accessed before. What does this alert most likely indicate?

   • AA potential account compromise or malicious insider activity.
   • BA false positive caused by a VPN connection.
   • CA routine administrative task performed by the employee.
   • DA system error in the user behavior analytics tool.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A user behavior alert indicates that an employee is attempting to access a database containing customer PII outside of their normal working hours. The employee's role does not require access to this database. The access attempts are failing due to permissions. What is the most appropriate next action?

   • AGrant the employee temporary access to the database to see what they do.
   • BInvestigate the alert to determine if the access attempts are intentional or due to a misconfiguration.
   • CIgnore the alert because the access attempts are failing.
   • DImmediately terminate the employee's employment.
   Reveal Solution Discussion Select an answer first