MENU
Refer to the exhibit.
An engineer is investigating a case with suspicious usernames within the active directory. After the engineer investigates and cross-correlates events from other sources, it appears that the 2 users are privileged, and their creation date matches suspicious network traffic that was initiated from the internal network 2 days prior. Which type of compromise is occurring?
Suggested Answer: D
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
30 comments · newest first
HE
Herminia
6 months ago
I lean towards D) compromised network. The traffic is a big clue.
TH
Thomasena
6 months ago
True, but the focus is on the usernames. Insider makes more sense.
DI
Dianne
6 months ago
But what about B) compromised root access? That could explain the privileged users.
RA
Rashad
7 months ago
Agreed, the timing is suspicious.
WA
Wava
7 months ago
I think it's A) compromised insider. Sounds like an inside job.
OC
Ocie
7 months ago
Not sure, this could be a false flag too.
EL
Elli
7 months ago
I agree, the timing with the network traffic is suspicious.
IR
Irma
7 months ago
Wait, could it be compromised root access instead?
AN
Annice
8 months ago
Definitely A) compromised insider.
BI
Billy
8 months ago
Sounds like a compromised insider situation.
DA
Danica
8 months ago
I'm going with compromised insider. Those privileged users are probably up to no good, and the network traffic is the smoking gun.
DE
Delbert
8 months ago
Haha, I bet the engineer is just trying to cover up their own compromised root access. Classic IT shenanigans!
LA
Laquita
9 months ago
Nah, this is clearly a compromised network. Those suspicious activities are probably coming from outside the organization.
BR
Brittni
9 months ago
I'd say it's a compromised database table. Those privileged users could be accessing sensitive data without authorization.
MA
Ma
9 months ago
Hmm, this seems like a classic case of a compromised insider. The suspicious usernames and network traffic are definitely red flags.
ZE
Zena
9 months ago
This reminds me of a practice question where we discussed network anomalies linked to user accounts. I wonder if compromised network might be the right answer?
DA
Daryl
9 months ago
I'm not entirely sure, but I think compromised root access could also fit if those users have elevated privileges. It’s tricky!
PH
Phil
9 months ago
I remember studying about compromised insiders, especially in relation to suspicious usernames in active directories. That seems like a strong possibility here.
BA
Barney
10 months ago
Ah, I see what's going on here. The suspicious user creation and network traffic point to a compromised insider. I'm confident option A is the correct answer.
AS
Ashley
10 months ago
This seems like a good opportunity to apply some of the incident response strategies we've been practicing. I'll methodically analyze the evidence and consider the different attack vectors before selecting my answer.
BU
Buddy
10 months ago
I'm a bit confused on this one. The question mentions database tables, but the options don't seem to directly match that. I'll need to re-read the details and see if I can eliminate some of the options.
CH
Chara
11 months ago
I still believe A) is the best choice. Insider threats are tricky!
DA
Dacia
11 months ago
I feel like the creation date matching suspicious traffic points more towards a compromised insider scenario. That’s what we practiced last week!
GR
Graciela
11 months ago
Okay, let's see here. Suspicious usernames, privileged access, and network traffic - that sounds like a compromised insider situation to me. I'll go with option A.
WA
Wayne
11 months ago
Hmm, this seems like a tricky one. I'll need to carefully review the details in the exhibit and think through the potential types of compromise.
OW
Owen
6 months ago
I still lean towards compromised insider. It fits the scenario.
NI
Nicholle
6 months ago
True, that could indicate compromised network access.
EL
Elroy
6 months ago
But what about the network traffic?
WI
Winifred
10 months ago
Agreed, the usernames seem suspicious.
BR
Brent
10 months ago
I think it's a compromised insider situation.