200-201 Question 380
Single answerA cybersecurity analyst is reviewing logs from a critical server and notices the presence of a service account that is actively logged in during non-standard hours. The account has also been used to execute commands that are outside its normal operational scope. What is the most appropriate action the analyst should take to address this observation?
- A
Immediately disable the service account to prevent further misuse.
- B
Investigate the account's activity further to determine if it has been compromised.
- C
Reset the password for the service account and monitor for further activity.
- D
Assume the activity is authorized since service accounts often run automated tasks.
Show answer and explanation
Correct answer: B
Explanation
When unexpected or anomalous activity is detected on a service account, it is critical to first investigate the behavior to confirm whether it is legitimate or potentially malicious. Jumping to conclusions, such as disabling the account or resetting its password, could disrupt operations. Assuming the activity is authorized without investigation is not a sound security practice. Therefore, further investigation is the correct approach to analyze the behavior and take appropriate action if necessary.
- A. Incorrect.
Disabling the account immediately could disrupt critical services if this account is legitimately used for automated tasks. This action should only be taken if malicious activity is confirmed.
- B. Correct.
Investigating the account's activity further is the most appropriate action, as it allows the analyst to determine if the account's behavior is unauthorized or if it is performing legitimate tasks.
- C. Incorrect.
Resetting the password without a proper investigation could disrupt services and might not address the root cause if the account has been compromised.
- D. Incorrect.
Assuming the activity is authorized without verification is risky and could lead to undetected misuse of the account if it has indeed been compromised.