300-215 Question 87
Single answerDuring an investigation of an application hosted on a cloud platform, you are tasked with analyzing its logs to detect potential unauthorized access. The application generates cloud-native logs that include metadata such as user IDs, timestamps, IP addresses, and API call details. Which log entry would most likely indicate suspicious activity?
- A
A log entry with repeated failed authentication attempts from a single IP address in a short time frame
- B
A log entry showing an API request to access customer data with a valid user ID and no anomalies
- C
A log entry with a timestamp showing access to the application during normal business hours by a known user
- D
A log entry showing an API call from an IP address geolocated in an unexpected country
Show answer and explanation
Correct answer: A
Explanation
Repeated failed authentication attempts are a strong indicator of potential malicious activity, such as a brute force attack. Analyzing cloud-native logs for patterns like these is a critical skill for detecting and responding to threats in cloud environments.
- A. Correct.
Repeated failed authentication attempts from a single IP address in a short time frame could indicate a brute force attack or credential stuffing attempt, making it suspicious.
- B. Incorrect.
A valid API request with no anomalies is normal behavior and does not indicate suspicious activity.
- C. Incorrect.
Access during normal business hours by a known user is standard activity and not inherently suspicious.
- D. Incorrect.
While an API call from an unexpected country might be unusual, it does not immediately indicate malicious intent without further context or corroborating evidence.