Exam 350-201 topic 1 question 3 discussion

All the dumps seem to share a common root source and all seem to contain the same wrong answers. Having just taken this exam, I can say that this dump is so out of date as to be almost worthless for other than a study guide.

Based on the information provided, the activity that most likely triggered the behavior analytics tool is: B. Accessing the server with financial data. The behavior analytics tool likely detected suspicious activity when the threat actor attempted to access the server with corporate financial data, which triggered the system to disconnect the session and disable the administrator's account. This response suggests that the system detected and responded to the threat actor's behavior, indicating that a behavior analytics tool was in place. Accessing the Active Directory server and multiple servers could be considered suspicious activity, but not necessarily indicative of a threat. Downloading more than 10 files may also be considered suspicious, but it is less likely to be the specific trigger for the behavior analytics tool in this scenario.

I also believe its B.. Because financial data is most likely under PAM( Priviliged Access management). If a admin can access these financial data , that would be dangerous. Only privileged users can access financial data, so answer must be B...

All dump sites show same answer - accessing multiple servers, so probably it's correct one

All dump sites show same answer - accessing multiple servers, so probably it's correct one

I believe the answer is B... If you have admin then it is normal to jump through many RDPs for many tasks, an admin in a financial server would be more suspicious. Accesing multiple servers would probably raise many False Positive alerts and disabled accounts.