350-201 Question 144
Single answerAs a security analyst, you are using a SIEM platform integrated with UEBA capabilities to monitor user and entity activity within your organization. You notice an alert indicating that a user account, which typically logs in from the United States during standard business hours, has logged in from an unknown IP address in another country at 3:00 AM local time. Which action should you take to analyze this anomalous behavior further?
- A
Correlate the login event with other events such as file access or privilege escalation activities.
- B
Immediately block the user account and report the incident to the authorities.
- C
Ignore the alert as it could be a false positive caused by a legitimate VPN connection.
- D
Trigger a full organizational audit to investigate all user accounts and their activity.
Show answer and explanation
Correct answer: A
Explanation
Analyzing anomalous user and entity behavior requires correlating the suspicious event with other related activities to gain context. This step ensures that the incident is thoroughly investigated before taking any action. By using the SIEM's correlation capabilities, you can identify patterns that confirm or disprove the malicious intent behind the alert.
- A. Correct.
Correlating the login event with other activities, such as file access or privilege escalation, helps determine whether the anomalous behavior is part of a larger malicious activity or a standalone event.
- B. Incorrect.
Immediately blocking the account and reporting to authorities without further analysis may lead to unnecessary disruptions or false alarms if the behavior is legitimate.
- C. Incorrect.
Ignoring the alert without validation is a poor security practice as it could allow potential malicious activity to go unnoticed.
- D. Incorrect.
Triggering a full organizational audit is a disproportionate response to a single anomalous login event and would consume significant resources unnecessarily.