SY0-701 Question 481
Single answerAnomalous behavior recognition: Risky , Unexpected , UnintentionalA security analyst is reviewing alerts from a user and entity behavior analytics (UEBA) platform. One employee in the finance department authenticated successfully from the corporate office during normal business hours, then accessed a public file-sharing site and uploaded a spreadsheet containing customer invoice data. The employee states they were trying to send the file to an external auditor because email size limits blocked the attachment. The organization has an approved secure portal for third-party document exchange, and policy prohibits use of unsanctioned file-sharing services for company data. Which type of anomalous behavior best describes this activity?
- A
Risky behavior
- B
Unexpected behavior
- C
Unintentional behavior
- D
Normal business activity
Show answer and explanation
Correct answer: A
Explanation
The best answer is risky behavior. Security+ expects candidates to distinguish between malicious activity and non-malicious actions that still create security exposure. In this case, the employee intentionally performed an action that bypassed approved security controls and violated policy, increasing the risk of data leakage. That fits risky behavior better than unexpected or unintentional. This aligns with common security best practices in acceptable use, data handling, and third-party data transfer controls: organizations should use sanctioned mechanisms for sensitive file exchange, enforce least privilege and approved workflows, and monitor for policy violations with tools such as DLP, CASB, SIEM, and UEBA. Guidance from frameworks such as NIST's Cybersecurity Framework and NIST SP 800-53 supports enforcing approved data flows, monitoring anomalous activity, and reducing data exfiltration risk through defined security controls and user awareness.
- A. Correct.
Correct. This is risky behavior because the employee knowingly used an unsanctioned public file-sharing service to transfer sensitive business data, creating security and compliance exposure. Even if the employee had a business reason and no malicious intent, the action increased the likelihood of data loss or unauthorized disclosure. In anomalous behavior analysis, risky behavior includes actions that violate policy or bypass approved controls in a way that elevates organizational risk.
- B. Incorrect.
Incorrect. Unexpected behavior usually refers to activity that deviates from a user's normal baseline or established pattern, such as logins from unusual locations, access at odd hours, or attempts to use systems outside the employee's role. In this scenario, the strongest classification is not merely that the action was unusual, but that it introduced clear security risk by using a prohibited external service for sensitive data transfer.
- C. Incorrect.
Incorrect. Unintentional behavior generally describes accidental actions, such as sending data to the wrong recipient, misconfiguring permissions, or clicking a phishing link without understanding the consequences. Here, the employee intentionally uploaded the file to the public service. The lack of malicious intent does not make the act unintentional.
- D. Incorrect.
Incorrect. This is not normal business activity because the organization already provides an approved secure portal for third-party sharing, and policy explicitly prohibits unsanctioned file-sharing services for company data. A legitimate business purpose does not make a policy-violating and high-risk action normal or acceptable.