200-201 Question 369
Single answerDuring a network investigation, a cybersecurity analyst notices unusually long session durations for a specific user's connection to a cloud-based application. What could this behavior most likely indicate?
- A
The user is performing legitimate data backup activities.
- B
The user is experiencing an unstable network connection causing retries.
- C
The user account may be compromised and is being used for data exfiltration.
- D
The application has a built-in feature that requires persistent sessions.
Show answer and explanation
Correct answer: C
Explanation
Unusually long session durations can be indicative of malicious activity, such as data exfiltration by a compromised account. Cybersecurity analysts must evaluate these anomalies in the context of user behavior, application functionality, and network activity to determine whether further investigation is needed. In this scenario, the most likely explanation is that the user's account has been compromised and is being exploited for data theft.
- A. Incorrect.
Legitimate data backup activities may result in high bandwidth usage but not necessarily in unusually long session durations. This option does not adequately explain the observed behavior.
- B. Incorrect.
An unstable network connection could cause retries and potentially extend session durations. However, it would not typically result in sessions being unusually long without other observable disruptions.
- C. Correct.
A compromised user account being used for data exfiltration is a strong possibility in this scenario. Attackers often maintain long session durations to avoid detection while transferring large amounts of data.
- D. Incorrect.
While some applications may require persistent sessions, this behavior is generally predictable and well-documented. Unusually long sessions would not likely occur without additional suspicious activity.