Objective 2.4: Given a scenario, analyze indicators of malicious activity
Security+ SY0-701 practice question
The identity team suspects that an attacker has obtained a sales manager's credentials. The manager works from the Chicago office and has not traveled this month. Which TWO findings MOST strongly indicate that someone other than the manager is actively using the account?
- A successful sign-in from Chicago at 08:55, followed by a successful sign-in from an IP address in Romania at 09:10(Correct)
Correct. Two successful sign-ins, Chicago and then Romania 15 minutes later, are physically impossible for one person who has not traveled. This impossible travel indicator shows that a second party is signing in with the credentials.
- Fifty failed sign-ins to the account from an unfamiliar IP address over ten minutes, ending in an account lockout
This is a genuine indicator of malicious activity, most likely a brute-force or credential guessing attempt, and it deserves investigation. But every attempt failed and the account was locked, so it shows someone trying to get in, not someone using the account. It even suggests that this person does not have the correct password, since someone who did would not need fifty guesses.
- A successful sign-in from the manager's usual laptop at 05:40, about two hours earlier than the manager normally starts work
An unusual sign-in time is a weak, anomalous-behavior indicator. The sign-in came from the manager's own laptop, and people sometimes start early, so on its own this does not show that a different person is using the account. It is far weaker than the impossible-travel and concurrent-session findings.
- A session active on the manager's office workstation while a second session from a cloud hosting provider's IP address downloads the full customer list(Correct)
Correct. This is concurrent session usage: the manager is working at the office while a second session from hosting infrastructure is pulling bulk data. Two simultaneous sessions from different places, combined with unusual data access, strongly indicate account misuse.
- A sign-in from a new IP address that belongs to the company's VPN concentrator, the day after the network team migrated the VPN
The new address belongs to the company's own VPN and appeared right after a documented VPN migration, so a change in source IP is expected.
Explanation
Separate indicators of an attempted attack from indicators that someone is already using an account. Impossible travel (successful sign-ins from places too far apart for the time between them) and concurrent session usage (the same account active in two places at once, especially from unexpected infrastructure) show that a second party has successfully authenticated. Failed attempts and lockouts show someone trying to get in, and odd timing from the user's own device is weak evidence on its own.