A security analyst is investigating an alert arising from an impossible travel pattern. Within the span of 30 minutes, the email system saw successful authentication from two IP addresses, which…

Question

Options

• AVerify email server NTP synchronization status
• BValidate GeoIP data source
• CReview VPN authentication logs
• DVerify the user's recent travel activities

• A
  57% (21)
• B
  14% (5)
• C
  5% (2)
• D
  24% (9)

Explanation

Before taking any action on an impossible travel alert, the analyst must establish that the underlying data is trustworthy. Verifying NTP (Network Time Protocol) synchronization on the email server (Answer A) is the foundational step because the entire 'impossible travel' premise relies on the accuracy of authentication timestamps. If the server's clock is drifting or misconfigured, two authentications that actually occurred hours apart could appear to have happened within the same 30-minute window, generating a false positive. Without confirmed time integrity, all subsequent analysis (reviewing VPN logs, validating GeoIP, checking travel records) is built on potentially unreliable data. Once NTP synchronization is confirmed and timestamps are trustworthy, the analyst would logically move to validating GeoIP accuracy and reviewing VPN logs, since a VPN could explain the geographic discrepancy with a single legitimate user.

No community discussion yet for this question.