300-215 Question 117
Single answerYou are investigating a potential incident involving unauthorized access to a critical server. The SIEM alert log indicates multiple failed authentication attempts followed by a successful login from an IP address located in a foreign country. The syslog from the server shows a high volume of file access activity immediately following the successful login. What should be your primary focus during the investigation?
- A
Identify the geolocation and owner of the suspicious IP address.
- B
Verify whether the successful login originated from a known user or service account.
- C
Analyze the IDS/IPS logs to check for suspicious activity from the identified IP address.
- D
Review the server's file access logs for unauthorized data exfiltration.
Show answer and explanation
Correct answer: B
Explanation
The primary focus during the investigation should be determining whether the successful login was authorized or unauthorized. This step helps establish whether the activity is part of a legitimate process or a security incident. Once this is determined, investigators can then proceed to analyze additional logs, such as IDS/IPS or file access logs, for further evidence of malicious activity, if needed.
- A. Incorrect.
While identifying the geolocation and owner of the suspicious IP address is useful, it does not directly address whether the login was authorized or unauthorized, which is critical to the investigation.
- B. Correct.
Verifying whether the successful login originated from a known user or service account is key to determining if the login was legitimate or part of unauthorized access.
- C. Incorrect.
Analyzing the IDS/IPS logs for suspicious activity is a valid step, but it should come after confirming the legitimacy of the login and understanding the initial access vector.
- D. Incorrect.
Reviewing the server's file access logs for unauthorized data exfiltration is important but should be done after confirming whether the login itself was authorized.