350-201 Question 143
Single answerYou are a security analyst reviewing SIEM data integrated with a User and Entity Behavior Analytics (UEBA) solution. You notice a user account that is attempting to access sensitive files outside of normal work hours. Additionally, the same account has triggered excessive failed login attempts at an unusual location. What is the most appropriate action to take based on this anomalous behavior?
- A
Investigate the user's activity further and escalate to the incident response team if necessary.
- B
Ignore the activity since it could be a false positive caused by a legitimate user working late.
- C
Immediately disable the user's account to prevent further access.
- D
Create a new rule in the SIEM to block access to sensitive files during non-work hours.
Show answer and explanation
Correct answer: A
Explanation
When analyzing anomalous user behavior detected by UEBA, it is critical to investigate further to determine if the behavior is genuinely malicious or a false positive. Escalation to the incident response team should occur if the activity is confirmed to be a threat. Immediate response actions like disabling accounts or creating rules should only be taken after confirming the nature of the anomaly.
- A. Correct.
This is the correct option. Investigating the activity further helps confirm if the behavior is indeed malicious or a false positive, allowing you to take informed action like escalating to incident response.
- B. Incorrect.
Ignoring the activity without investigation could leave a potential security breach unaddressed, which is not a best practice in cybersecurity.
- C. Incorrect.
Disabling the user's account without investigation might disrupt legitimate work if the behavior turns out to be a false positive.
- D. Incorrect.
While creating rules to block access during non-work hours might help reduce risk in the future, it does not address the immediate potential threat.