MENU
An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)
Suggested Answer: A, B
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
9 comments · newest first
AL
Alberta
12 months ago
Not sure if increased emails alone should trigger an alert.
EL
Eleonore
12 months ago
I think the competitor domain is the main issue here.
RO
Rodolfo
1 year ago
Wait, logging in from a first-seen country? That seems sketchy!
JA
Jame
1 year ago
Logging in during non-working hours is a big red flag too.
BR
Brynn
1 year ago
Definitely the email forwarding to an external domain!
ED
Edelmira
1 year ago
Okay, let me break this down step-by-step. I know I've seen this security flow before, I just need to recall the right terminology.
GE
Gerald
1 year ago
I'm not entirely sure about this one. I'll need to review the course materials and see if I can find any guidance on the best way to tackle this type of question.
KE
Kerry
1 year ago
I think the answer is Data Classification. That feature allows you to identify and classify sensitive data in Salesforce.
BO
Bong
1 year ago
Not entirely sure, but "Service activities" sounds plausible too. It's always tricky to remember how these terms are used.