SY0-701 Question 273
Single answerMonitoringA security analyst is tuning the company’s monitoring strategy after a recent incident in which an attacker used valid employee credentials to access a file server after business hours and copy a large volume of sensitive data to an external host. Management wants earlier detection of similar activity without relying on users to report problems. Which monitoring improvement would BEST help identify this type of attack in the future?
- A
Configure the SIEM to baseline normal user and host activity, then alert on anomalies such as after-hours logins, unusual data transfer volumes, and connections to unfamiliar external destinations
- B
Increase the password expiration frequency for all employees from 90 days to 30 days
- C
Disable all outbound traffic from the file server at the firewall to prevent any future exfiltration attempts
- D
Require quarterly security awareness training focused on phishing and password safety
Show answer and explanation
Correct answer: A
Explanation
The key clue is that the attacker used valid credentials, accessed resources after hours, and transferred a large amount of data externally. That pattern points to the need for monitoring that can detect abnormal behavior rather than simply failed logins or malware signatures. Security teams commonly use SIEM correlation, behavior analytics, and anomaly detection to identify impossible travel, unusual login times, spikes in data transfer, new external destinations, and deviations from a user’s normal access patterns. This aligns with Security+ monitoring concepts such as log aggregation, event correlation, alerting, and baselining.
Best practices from sources such as NIST SP 800-61 (Computer Security Incident Handling Guide) and NIST SP 800-137 (Information Security Continuous Monitoring) emphasize continuous monitoring, centralized log analysis, and detection of anomalous events to improve early identification of incidents. While preventive controls like firewall restrictions and administrative measures like password policies and awareness training are valuable parts of a defense-in-depth strategy, they do not answer the specific need for earlier detection through monitoring.
- A. Correct.
Correct. This is the best monitoring-focused improvement because it directly addresses detection of suspicious behavior that may occur even when valid credentials are used. Baselining normal activity and alerting on deviations is a common SIEM/UEBA-style approach for identifying compromised accounts, abnormal access times, unusual data movement, and unexpected outbound connections. In this scenario, the attacker blended in by using legitimate credentials, so behavior-based monitoring is more effective than controls that only focus on authentication success or user reporting.
- B. Incorrect.
Incorrect. More frequent password expiration is an administrative control, not a monitoring improvement. It also would not reliably detect or stop an attacker who is already using compromised valid credentials. Modern guidance, including NIST recommendations, generally favors screening passwords for compromise and strength over forcing frequent password changes without evidence of compromise.
- C. Incorrect.
Incorrect. This might reduce risk in some environments, but it is not the best answer because the question asks for a monitoring improvement to identify similar attacks earlier. Blocking all outbound traffic from a file server could also disrupt legitimate operations such as backups, updates, or integrations unless carefully engineered. It is more of a restrictive preventive control than a monitoring enhancement.
- D. Incorrect.
Incorrect. Security awareness training is useful and may reduce credential theft, but it does not provide direct technical monitoring or early detection of malicious activity already occurring in the environment. The scenario specifically asks for a way to identify similar attacks without depending on user reports.