Exam CAS-004 topic 1 question 383 discussion

The best course of action is to C. Disable the jdoe account; it is likely compromised. The alerts show successful logon events for the user jdoe on multiple systems in different geographical locations within a short timeframe, which is suspicious and indicative of a compromised account. Disabling the jdoe account will prevent further unauthorized access while the situation is investigated.

C. Disable the jdoe account; it is likely compromised.

C. Disable the jdoe account; it is likely compromised. Rationale: Multiple successful logon events involving the "jdoe" account across different systems within a short time frame indicate potential suspicious behavior. This repeated successful logon activity, especially across different servers (abc-usa-fs1, abc-ger-fs1, abc-web01), raises suspicions of a compromised account or potentially unauthorized access.

The answer is A. Here's Why: It looks like a file transfer (FTP) was logged by the abc-usa-fw01 firewall located in the USA to document a file transfer from file server ger-fs1 located in Germany to a Web (server?) abc-web01, then sometime later Web (server?) abc-web01 logged a Successful login by the Administrator account. Which would potentially give the Admin access to the data that was transferred. Furthermore, both of these events were marked as High Severity alerts by the SIEM, therefore, they should be investigated first.

C is the right answer since we see the jdoe account exporting traffic via ftp