CS0-003 · Question #73
A security analyst is reviewing the following Internet usage trend report: Which of the following usernames should the security analyst investigate further?
The correct answer is B. User 2. The analyst should investigate User 2, as their internet usage likely exhibits anomalous or suspicious patterns that warrant further scrutiny.
Question
A security analyst is reviewing the following Internet usage trend report:
Which of the following usernames should the security analyst investigate further?
Exhibit
Options
- AUser 1
- BUser 2
- CUser 3
- DUser 4
How the community answered
(59 responses)- A10% (6)
- B81% (48)
- C5% (3)
- D3% (2)
Why each option
The analyst should investigate User 2, as their internet usage likely exhibits anomalous or suspicious patterns that warrant further scrutiny.
User 1 is presumed to have normal or less suspicious internet usage patterns compared to User 2, and therefore does not require immediate investigation based on the implied report data.
Based on typical security analysis of usage trends, User 2 must have displayed an anomalous pattern, such as unusually high data transfer, access to suspicious categories of websites, or activity at irregular hours, indicating potential compromise or policy violation. These deviations from baseline behavior are prime indicators for a security analyst to investigate further for potential threats or misuse.
User 3 is presumed to have normal or less suspicious internet usage patterns compared to User 2, and therefore does not require immediate investigation based on the implied report data.
User 4 is presumed to have normal or less suspicious internet usage patterns compared to User 2, and therefore does not require immediate investigation based on the implied report data.
Concept tested: Identifying anomalous user behavior
Source: https://learn.microsoft.com/en-us/azure/sentinel/identify-anomalous-behavior
Topics
Community Discussion
No community discussion yet for this question.