A security administrator using CrowdStrike Falcon wants to audit user account activity to identify potential risks associated with compromised or overprivileged accounts. Which of the following…

Question

Options

• AA developer accesses a cloud resource repository during standard working hours.
• BA non-administrative user suddenly escalates privileges and modifies cloud security policies.
• CA user requests temporary access to a sensitive database as part of an approved change request.
• DA user logs in from a new geographic location for the first time but performs no unusual actions.

• A
  23% (7)
• B
  57% (17)
• C
  7% (2)
• D
  13% (4)

Explanation

Option A: Developers accessing repositories during normal hours is expected behavior, unless there are signs of unauthorized activity. Option B: Privilege escalation and modification of security policies by a non-administrative user is a strong indicator of risk. This could suggest account compromise, insider threats, or policy violations, requiring immediate investigation. Option C: Temporary access requests for databases that follow approval workflows do not indicate unauthorized activity or risk. Option D: A new geographic login might warrant further monitoring, but without additional suspicious actions, it is not a definitive security risk.

No community discussion yet for this question.