2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A user behavior alert shows that a user is attempting to access a system that contains export-controlled data. The user does not have the required clearance. Threat intelligence indicates that a recent phishing campaign is targeting users in the same department. What is the most appropriate next action?

   • AEscalate the alert to law enforcement immediately.
   • BIgnore the alert because the user did not successfully access the system.
   • CContain the user's access to the system and investigate the alert, considering the threat intelligence.
   • DMonitor the user's activity for a week before taking any action.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A user behavior alert shows that an employee has been accessing a database containing customer personal data from a personal device. The organization is subject to GDPR and has a policy that requires reporting any personal data breach to the supervisory authority within 72 hours. The employee has a history of working from personal devices, and the database access is consistent with their job role. What should the analyst do?

   • AInvestigate the database access to determine if the personal device is authorized and if the data was transferred.
   • BIgnore the alert because the employee has a history of working from personal devices.
   • CDisable the employee's account immediately because personal device access is a potential breach.
   • DReport the incident to the supervisory authority immediately because personal data was accessed.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is triaging two user behavior alerts. Alert 1: a user with a history of downloading large files from the internet downloaded a 5 GB file from a known software vendor. Alert 2: a user with no history of remote access logged in from a new country and immediately accessed a sensitive database. The organization's policy prioritizes unusual access to sensitive data. Which alert should be investigated first?

   • ABoth alerts should be investigated simultaneously with equal priority.
   • BAlert 1, because the download is large and may contain malware.
   • CAlert 2, because the user accessed a sensitive database from a new country without a history of remote access.
   • DNeither alert should be investigated because both users may have legitimate reasons.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A user behavior alert shows that an employee in a regulated industry has been uploading customer personal data to a personal cloud storage account. The organization has a legal obligation to report data breaches to the regulatory authority within 72 hours. The upload is still ongoing. What should the analyst do first?

   • AWait for the upload to complete so that a full forensic image can be captured.
   • BBlock the upload and isolate the user's endpoint to prevent further data loss.
   • CContact the employee to ask if they have permission to upload the data.
   • DNotify the regulatory authority immediately before taking any other action.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A user behavior alert indicates that an employee has been accessing a database containing financial records outside of their normal working hours. The employee is a financial analyst and has legitimate access to this database. What is the most appropriate next action?

   • AIgnore the alert because the employee has legitimate access.
   • BInvestigate the context of the access, such as whether the employee is working on a time-sensitive project.
   • CContain the employee's access because the activity is outside normal hours.
   • DEscalate the alert to management for disciplinary action.
   Reveal Solution Discussion Select an answer first