Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Cisco 350-201 Exam - Topic 10 Question 16 Discussion

An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)
A) domain belongs to a competitor and B) log in during non-working hours
C) email forwarding to an external domain
D) log in from a first-seen country
E) increased number of sent mails

Cisco 350-201 Exam - Topic 10 Question 16 Discussion

Actual exam question for Cisco's 350-201 exam
Question #: 16
Topic #: 10
[All 350-201 Questions]

An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: A, B

by Yoko at May 04, 2022, 07:17 PM

Limited Time Offer

25%

Off

Get Premium 350-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Alberta
10 months ago
Not sure if increased emails alone should trigger an alert.
upvoted 0 times
...
Eleonore
10 months ago
I think the competitor domain is the main issue here.
upvoted 0 times
...
Rodolfo
11 months ago
Wait, logging in from a first-seen country? That seems sketchy!
upvoted 0 times
...
Jame
11 months ago
Logging in during non-working hours is a big red flag too.
upvoted 0 times
...
Brynn
11 months ago
Definitely the email forwarding to an external domain!
upvoted 0 times
...
Edelmira
11 months ago
Okay, let me break this down step-by-step. I know I've seen this security flow before, I just need to recall the right terminology.
upvoted 0 times
...
Gerald
11 months ago
I'm not entirely sure about this one. I'll need to review the course materials and see if I can find any guidance on the best way to tackle this type of question.
upvoted 0 times
...
Kerry
11 months ago
I think the answer is Data Classification. That feature allows you to identify and classify sensitive data in Salesforce.
upvoted 0 times
...
Bong
11 months ago
Not entirely sure, but "Service activities" sounds plausible too. It's always tricky to remember how these terms are used.
upvoted 0 times
...

Save Cancel