Determine How to Monitor Syslog and Audit Log CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 6)

Questions 26–26

1. 26expert · hard

   An analyst is reviewing audit logs and sees an event where a user's group membership was changed from 'Users' to 'Domain Admins', and then changed back to 'Users' within five minutes. The user is a regular employee. What is the most likely explanation?

   • AThe user is a victim of a privilege escalation attack.
   • BAn administrator temporarily granted the user admin rights to perform a specific task, then revoked them.
   • CThe user is attempting to hide their tracks by changing their own group membership.
   • DThe audit log is incorrect due to a system error.
   Reveal Solution Discussion Select an answer first