2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security operations center receives three user behavior alerts simultaneously: (1) a marketing user failed to authenticate five times in 10 minutes, (2) a system administrator accessed 50 servers via remote desktop in one hour, and (3) a contractor downloaded 10 GB of source code from a repository they have never accessed before. The organization has a policy that prioritizes data exfiltration risks. Which alert should be investigated first?

   • AThe contractor's source code download
   • BThe marketing user's failed logins
   • CThe system administrator's remote desktop access
   • DAll three alerts should be investigated simultaneously with equal priority
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A user behavior alert indicates that an employee has been sending emails with encrypted attachments to an external email address. The employee's role involves sending financial reports to auditors, and the external address is a known auditor's domain. The organization has a policy that requires investigation of any encrypted email sent to external addresses, but does not require automatic blocking. What should the analyst do?

   • AIgnore the alert because the recipient is a known auditor domain.
   • BEscalate the alert to the incident response team for a full investigation.
   • CInvestigate the email content and the recipient to confirm it is a legitimate auditor communication.
   • DBlock the external email address and quarantine the employee's email account.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A user behavior alert flags a database administrator who has been querying the customer database at 3 AM for the past three nights. The administrator has a history of performing maintenance during off-hours, but the queries are SELECT statements that return large result sets. The organization has a policy that requires investigation of any unusual data access, but does not require automatic containment. The administrator is the only person with access to the database. What should the analyst do?

   • AEscalate the alert to the incident response team for a full investigation.
   • BDisable the administrator's account because the queries are unusual and occur at 3 AM.
   • CInvestigate the queries to determine if they are part of a legitimate data migration or reporting task.
   • DBlock the administrator's access to the customer database until the queries are explained.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A user behavior alert shows that a user is downloading a large volume of sensitive customer data to a USB drive. The user has no legitimate business need for this data. What is the most appropriate next action?

   • AIgnore the alert because the user has legitimate access to the data.
   • BMonitor the user's activity for a few days to see if the behavior continues.
   • CEscalate the alert to the user's manager for a performance review.
   • DContain the threat by disabling the user's access to the sensitive data and initiating an investigation.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A user behavior alert flags a network administrator who has been logging in from a new VPN endpoint and running configuration commands on routers during off-hours. The administrator has a history of on-call maintenance work and the commands are consistent with scheduled network changes. The organization's policy requires that off-hours administrative activity be monitored but not automatically blocked. What should the analyst do?

   • AVerify the scheduled change ticket and the VPN endpoint, then continue monitoring the session.
   • BEscalate the alert to the incident response team for a full investigation.
   • CDisable the administrator's account until the activity is fully explained.
   • DTerminate the session immediately because off-hours access is always suspicious.
   Reveal Solution Discussion Select an answer first