6.3 Audit User Account Activity and Permissions to Identify Risks CCCS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An auditor is reviewing logs and finds that a user with 'Finance Analyst' role has been accessing the 'Accounts Payable' system at unusual hours and from a VPN endpoint. The user's role is documented to have 'Read' access to the system. The activity log shows the user has been downloading large volumes of data. The auditor also notices that the user's account has been granted 'Write' access to the system by a 'Finance Manager' two days ago. What is the most significant risk indicator?

   • AThe recent grant of 'Write' access, which is not part of the user's documented role
   • BThe unusual login hours, which suggest the user is accessing the system outside of normal business hours
   • CThe large volume of data downloads, which may indicate data exfiltration
   • DThe use of a VPN, which may indicate the user is trying to hide their location
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During an audit of user account activity, an analyst notices a user account has multiple failed login attempts followed by a successful login within a short time. Which behavior does this pattern most likely indicate?

   • AA scheduled task running with stored credentials
   • BA brute-force attack that succeeded
   • CA user simply forgetting their password
   • DA normal user behavior pattern
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is reviewing user activity and permissions in a hybrid cloud environment. They find that a 'System Administrator' account has been used to create a new user account with 'Global Administrator' permissions. The System Administrator role is documented to have permission to create user accounts, but not to assign 'Global Administrator' role. The new account has not been used yet. What is the most appropriate immediate action?

   • ADisable the new account and investigate the System Administrator's activity to determine if the action was authorized
   • BChange the System Administrator's permissions to allow them to assign Global Administrator role, as they may need it for their job
   • CLeave the new account active but remove the Global Administrator role, since the account has not been used
   • DContact the System Administrator to ask if they created the account for a legitimate purpose
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst at a financial firm reviews the previous day's user activity logs. The analyst notices that a junior accountant, who typically logs in between 8:00 AM and 6:00 PM from the corporate office, authenticated successfully at 2:47 AM from an IP address geolocated to a foreign country. The account then performed a bulk export of client records to a personal cloud storage URL. Which combination of findings should the analyst prioritize as the most significant risk indicators?

   • AThe unusual login time combined with the foreign IP address and the bulk data export to an external destination
   • BThe bulk export of client records, because data exfiltration is the only action that directly violates data protection policy
   • CThe foreign IP address, because geolocation alone is the most reliable indicator of unauthorized access
   • DThe 2:47 AM login time, because off-hours access is the strongest single indicator of a security incident
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a potential data breach. The analyst reviews the activity logs of a user account and finds that the user logged in from a new device, then immediately attempted to access several internal resources that are not part of their normal job function. The user's role is 'Sales Representative', but they attempted to access the 'HR Payroll' share. What should the analyst do first?

   • AImmediately disable the user's account to prevent further unauthorized access
   • BContact the user to ask why they attempted to access the HR Payroll share
   • CCorrelate the user's attempted access with their assigned permissions to determine if the access was possible
   • DCheck if the user's device is compliant with the company's security policies
   Reveal Solution Discussion Select an answer first