SY0-701 Question 340
Single answerUser behavior analyticsA company uses a SIEM with user behavior analytics (UBA) to detect insider threats. Over the past week, the security team has seen alerts for a finance employee who normally logs in from the corporate office between 8:00 a.m. and 5:00 p.m., accesses payroll files, and transfers less than 50MB per day. Last night, the same account authenticated successfully from a new geographic location at 2:15 a.m., accessed engineering design repositories for the first time, and uploaded 4GB of data to an external file-sharing site. The user claims they were asleep at that time. Which action should the security analyst take FIRST based on this UBA alert?
- A
Disable the account and begin the incident response process because the behavior strongly indicates account compromise or insider misuse
- B
Ignore the alert because UBA commonly generates false positives when employees travel or work late
- C
Tune the SIEM to stop alerting on after-hours logins so the team can focus on malware detections instead
- D
Wait for a second similar event before taking action, since one anomalous login is not enough evidence
Show answer and explanation
Correct answer: A
Explanation
User behavior analytics helps identify compromised accounts and insider threats by comparing current actions against a learned baseline of normal behavior. In this case, the alert is high fidelity because it combines several anomalies: unusual login time, new geographic source, access to repositories outside the user's normal job function, and a much larger-than-normal outbound transfer to an external destination. In Security+ terms, this is a strong indicator that the account may be compromised or being misused, so containment should occur first, followed by investigation under the organization's incident response process. This aligns with common guidance from NIST incident handling practices, such as NIST SP 800-61, which emphasizes containment to limit damage once a likely security incident is identified. UBA does not replace analyst judgment, but it provides valuable context for detecting deviations that signature-based tools may miss.
- A. Correct.
Correct. UBA is designed to establish a baseline of normal user activity and highlight meaningful deviations, such as impossible or unusual access patterns, abnormal time of access, access to data outside the user's role, and unusually large data transfers. In this scenario, several high-risk indicators occur together: a new location, unusual time, first-time access to engineering data, and large exfiltration to an external service, followed by the user's denial. The most appropriate first action is to contain the potential threat by disabling the account and starting incident response procedures, which may include validating logs, preserving evidence, resetting credentials, and determining scope.
- B. Incorrect.
Incorrect. While UBA can produce false positives, this scenario presents multiple correlated anomalies rather than a single weak signal. Treating it as routine noise would ignore clear indicators of compromise or malicious activity. Security best practice is to investigate and contain high-confidence alerts, especially when they involve sensitive data access and potential exfiltration.
- C. Incorrect.
Incorrect. Suppressing alerts for after-hours activity would remove visibility into a common indicator of compromise. The problem is not the existence of the alert, but the suspicious combination of events around it. SIEM tuning should reduce noise without blinding the team to risky behavior patterns that UBA is specifically intended to detect.
- D. Incorrect.
Incorrect. Waiting increases the risk of continued data loss or lateral movement. Security operations should prioritize timely containment when a user's behavior sharply deviates from baseline and suggests active abuse. Requiring repeated incidents before responding is not appropriate when the first event already indicates probable compromise or data exfiltration.