A security analyst observed the following activity from a privileged account: - Accessing emails and sensitive information - Audit logs being modified - Abnormal log-in times Which of the following…

The correct answer is D. Insider attack. The observed activity from a privileged account indicates an insider attack, which is when a trusted user or employee misuses their access rights to compromise the security of the organization. Accessing emails and sensitive information, modifying audit logs, and logging in at…

Submitted by kavita_s· Mar 6, 2026Security operations

Question

A security analyst observed the following activity from a privileged account:

Accessing emails and sensitive information
Audit logs being modified
Abnormal log-in times

Which of the following best describes the observed activity?

Options

AIrregular peer-to-peer communication
BUnauthorized privileges
CRogue devices on the network
DInsider attack

How the community answered

(29 responses)

A
3% (1)
B
21% (6)
C
10% (3)
D
66% (19)

Explanation

The observed activity from a privileged account indicates an insider attack, which is when a trusted user or employee misuses their access rights to compromise the security of the organization. Accessing emails and sensitive information, modifying audit logs, and logging in at abnormal times are all signs of malicious behavior by a privileged user who may be trying to steal, tamper, or destroy data, or cover their tracks. An insider attack can cause significant damage to the organization's reputation, operations, and compliance.

Topics

#Insider threat#Privileged account compromise#Abnormal behavior#Audit log modification

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice