A security team is investigating a potential data breach. They find that a user's account was used to access a sensitive file at 3:00 AM. The user claims they were asleep. The team checks the authentication logs and finds that the login succeeded with a valid password and a valid hardware token code. Which additional evidence would BEST help determine whether this was a legitimate use or a compromise?

The user's password change history

The IP address and geolocation of the login session

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 10)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 46–46

46expert · hard
A security team is investigating a potential data breach. They find that a user's account was used to access a sensitive file at 3:00 AM. The user claims they were asleep. The team checks the authentication logs and finds that the login succeeded with a valid password and a valid hardware token code. Which additional evidence would BEST help determine whether this was a legitimate use or a compromise?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Access Control Management GCCC Practice Questions (Page 10)

Questions 46–46

Keep studying — Access and Identity Management