350-201 Question 142
Select 3A company’s SIEM platform has flagged anomalous behavior from a user account, including multiple failed login attempts followed by a successful login from an unusual geographic location and the retrieval of a large volume of sensitive files. Using User and Entity Behavior Analytics (UEBA), what actions should a security analyst prioritize to investigate this activity?
- A
Correlate the flagged activity with the user's historical behavior and baseline patterns.
- B
Verify whether the user's credentials have been compromised on the dark web.
- C
Immediately disable the user account to prevent further activity.
- D
Review the geolocation and device information associated with the login.
- E
Perform a manual audit of all files accessed by the user during the anomalous session.
Show answer and explanation
Correct answers: A, B, D
Explanation
The correct actions involve leveraging UEBA to analyze the user's behavior in context and assess the legitimacy of the flagged activity. Correlating the activity with historical patterns, checking for credential compromise, and reviewing geolocation and device information provide a comprehensive understanding of the situation. While disabling the account and auditing files might be necessary later, they are not the first steps in the investigation process.
- A. Correct.
Correlating the flagged activity with the user's historical behavior and baseline patterns is a key function of UEBA and helps determine if the activity is truly anomalous or part of the user's typical behavior.
- B. Correct.
Verifying whether the user's credentials have been compromised on the dark web can provide critical context about how the activity occurred and whether it is part of a larger attack.
- C. Incorrect.
Immediately disabling the user account without additional investigation might disrupt business operations. This step should be considered only if the analysis confirms a threat.
- D. Correct.
Reviewing geolocation and device information helps determine if the login is consistent with the user's normal behavior or if it is suspicious, such as originating from a foreign or unusual location.
- E. Incorrect.
Performing a manual audit of all accessed files is time-intensive and not the most immediate action to take. Automated tools can assist with prioritizing specific files for review based on risk.