2.21 Determine the Next Action Based on User Behavior Alerts 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A user behavior alert indicates that a contractor has been accessing the company's source code repository at unusual hours and downloading large amounts of code. The contractor's contract is ending in two weeks, and they have a history of working on multiple projects. The organization's policy requires that any suspicious activity by contractors be escalated to the contracting officer, but does not require automatic account suspension. What should the analyst do?

   • AEscalate the alert to the contracting officer and recommend a review of the contractor's access needs.
   • BMonitor the contractor's activity for the remaining two weeks of the contract.
   • CDisable the contractor's account immediately because the contract is ending soon.
   • DContact the contractor to ask why they are downloading code.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   During alert triage, a security analyst sees two user behavior alerts. Alert A: A user with administrative privileges attempted to disable security logging. Alert B: A user attempted to access a shared printer outside of business hours. Which alert should be triaged as higher priority?

   • ABoth alerts have equal priority because both are user behavior alerts.
   • BAlert B, because printer access could indicate a security breach.
   • CAlert A, because it indicates a potential attempt to evade detection and involves privileged access.
   • DAlert B, because it occurred outside of business hours.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A user behavior alert flags a user who has been logging in from a new device and accessing the company's HR system, which is not part of their job role. The user recently transferred from the finance department to the HR department. The new device is a company-issued laptop. The organization has a policy that requires verification of any unusual access before taking action. What should the analyst do?

   • ADisable the user's account because the HR system access is outside their previous role.
   • BBlock the new device from accessing the HR system.
   • CVerify the user's new role and the device's compliance status, then close the alert as a false positive.
   • DEscalate the alert to the incident response team for a full investigation.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is reviewing two user behavior alerts. Alert A: a junior developer attempted to access the production database and was denied. Alert B: a senior developer with a history of accessing production successfully downloaded a large backup file. The organization has a policy that prioritizes successful data exfiltration over failed access attempts. Which alert should be investigated first?

   • ANeither alert should be investigated because the users are developers and may have legitimate reasons.
   • BAlert B, because the senior developer successfully downloaded a large backup file.
   • CBoth alerts should be investigated simultaneously with equal priority.
   • DAlert A, because the junior developer should not have attempted access at all.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A user behavior alert indicates that an employee has been accessing a file server from a new device and a new location. The employee is in the sales department and frequently travels. The new device is not registered in the company's device management system. The employee's account has MFA enabled, and the login succeeded. What should you do?

   • ATreat the alert as a false positive because the employee travels frequently and MFA succeeded.
   • BEscalate the alert to the incident response team immediately because of the unregistered device.
   • CInvestigate the device and verify with the employee before taking any action.
   • DDisable the employee's account because the device is not registered.
   Reveal Solution Discussion Select an answer first