350-201 Question 223
Select 4Your organization has detected unusual activity in its cloud-hosted database, and there is a suspicion of potential data exfiltration. As a cybersecurity analyst, which steps should you take to investigate this potential data loss effectively?
- A
Review access logs for unusual login patterns or unauthorized access attempts.
- B
Analyze data transfer logs to identify large or unusual amounts of data leaving the database.
- C
Immediately block all access to the database to prevent further potential exfiltration.
- D
Use data loss prevention (DLP) tools to identify sensitive data that may have been accessed or transferred.
- E
Check endpoint devices of users who recently accessed the database for potential malware or compromised credentials.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Investigating potential data loss requires a systematic approach that focuses on identifying unauthorized access, detecting unusual data transfer patterns, and assessing whether sensitive data was compromised. Reviewing database access logs, analyzing data transfer logs, using DLP tools, and checking endpoint devices provide a holistic view of the incident. Blocking access prematurely is not recommended unless the threat is confirmed, as it could disrupt operations unnecessarily.
- A. Correct.
Reviewing access logs is an essential step to analyze who accessed the database and whether there were any unauthorized access attempts.
- B. Correct.
Analyzing data transfer logs helps identify abnormal patterns, such as unusually large data transfers, which could indicate exfiltration.
- C. Incorrect.
Blocking all access immediately could disrupt critical business operations. The investigation should be conducted first unless the threat is confirmed and requires immediate containment.
- D. Correct.
DLP tools are useful for identifying whether sensitive data was accessed or transferred, providing clarity on the scope of the potential breach.
- E. Correct.
Since endpoint devices might be compromised, analyzing them for malware or credential compromise is a crucial step in understanding the root cause of the incident.