Exam 350-201 topic 1 question 64 discussion

Going with BD as well

It's C & E, the answer is in the question. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out.

C and D. We operates in world time so non-working hours in US doesn't equate. Hard to track all the competitors.

The two behaviors that triggered UEBA are: B. Log in during non-working hours E. Increased number of sent mails - ChatGPT

My answer is B. log in during non-working hours and C. email forwarding to an external domain UEBA (User and Entity Behavior Analytics) is a security technique that uses machine learning algorithms to identify abnormal behavior within an organization's network. In this scenario, two behaviors that likely triggered an UEBA alert are the employee logging in during non-working hours and forwarding an increased amount of emails to an external mail domain. These behaviors deviate from the employee's normal patterns of activity and may indicate an attempt to exfiltrate sensitive information to a competitor. A. domain belongs to a competitor is not a behavior, it's an information that's used in the investigation process. D. Log in from a first-seen country and E. increased number of sent mails also can be important indicators, but they are not enough to trigger UEBA alerts.

It's C and E

C &D. B is pointless if a employee works ''often'' in other countries... Please read the question. First country & external domain is the answer.

I will choose C, E, because these two conditions together trigger the alert.

C is pointless.

UEBA (User and Entity Behavior Analytics) (D). log in from a first-seen country User Behavior (B). log in during non-working hours User Behavior (C). email forwarding to an external domain This shit dont have sense... UEBA IS User and Entity Behavior Analytics REMEMBER!!

Could be AC https://docs.splunksecurityessentials.com/content-detail/flight_risk_email/

Confirmed it's CD

I agree 100%%

The employee travels often, hes proabaly used to working after work hours (Not B). It would be a pain to feed all competitor domains to UEBA, That was just a surprising conclusion not behavior. I think its CD