The Chief Information Officer (CISO) is concerned that certain systems administrators will privileged access may be reading other user's emails. Review of a tool's output shows the administrators…

The correct answer is A. Log analysis tool. Log analysis tools aggregate, parse, and correlate records generated by systems, applications, and web servers. Webmail platforms and email systems log every authentication event, including which account authenticated and from which source. A log analysis tool can surface…

Enterprise Security Operations

Question

The Chief Information Officer (CISO) is concerned that certain systems administrators will privileged access may be reading other user's emails. Review of a tool's output shows the administrators have used web mail to log into other users' inboxes. Which of the following tools would show this type of output?

Options

ALog analysis tool
BPassword cracker
CCommand-line tool
DFile integrity monitoring tool

How the community answered

(25 responses)

A
92% (23)
B
4% (1)
D
4% (1)

Explanation

Log analysis tools aggregate, parse, and correlate records generated by systems, applications, and web servers. Webmail platforms and email systems log every authentication event, including which account authenticated and from which source. A log analysis tool can surface patterns such as an administrator's account being used to access another user's mailbox, providing the CISO with the evidence needed to investigate. A password cracker attempts to recover credentials, a command-line tool executes system commands, and a file integrity monitoring tool detects file changes - none of these would reveal webmail login activity.

Topics

#log analysis#privileged access monitoring#insider threat#audit logs

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice