200-201 Question 130
Select 2A security analyst is tasked with reviewing logs to identify a potential insider threat. They are advised to prioritize specific data types that can reveal suspicious login attempts and unauthorized file access. Which data types should the analyst focus on?
- A
Authentication logs
- B
NetFlow data
- C
File integrity monitoring (FIM) data
- D
DNS query logs
- E
System performance metrics
Show answer and explanation
Correct answers: A, C
Explanation
To detect insider threats, analysts should focus on data types that provide visibility into user behavior and file access. Authentication logs help identify unusual login attempts, while file integrity monitoring (FIM) data helps detect unauthorized changes to files, both of which are critical for identifying malicious insider activity.
- A. Correct.
Authentication logs can reveal suspicious login attempts, such as multiple failed logins or logins from unusual locations, which are key indicators of an insider threat.
- B. Incorrect.
NetFlow data provides insights into network traffic patterns but is less useful for detecting specific insider activities like unauthorized file access or login anomalies.
- C. Correct.
File integrity monitoring (FIM) data helps detect unauthorized changes to files, which can be a strong indicator of malicious insider activity.
- D. Incorrect.
DNS query logs are valuable for detecting domain-related anomalies, such as command-and-control communications, but are not directly relevant to insider threats focused on login or file access.
- E. Incorrect.
System performance metrics track resource usage and performance but are not typically used to detect security incidents like insider threats.