Exam CS0-002 topic 1 question 85 discussion

D. ANDREAD. The reason she was most likely compromised is because of her impossible travel time from Italy to USA and she was PERMITTED access both times. LauraB is not compromised because yes, while she did travel from England to USA in 45 seconds, one login attempt was DENIED! So it's safe to assume one was the REAL Laura and one was a bad actor logging in at about the same time.

D is the correct answear due to the fact that the acces was permitted 2 times from different locations.

D. ANDREAD

If these are email 'access' logs from O365 i might expect to see users appear to connect from different regions depending on the resources that they are accessing but i would not expect access attempts from CHINA if i was based in the west, which i am. CINDYP is seen accessing email from USA which is permitted then a second later seen logging in from CHINA for which the access is DENIED. As a security analyst this would be the FIRST log entry i would query. Why are we seeing failed login attempts into CINDYP' account from CHINA?

D. For reasons already stated here.

I guess the chance Andrea connecting to a corporate IP or a VPN is not part of the information provided in the question eh

1hr:05mins difference in time for Andread is an impossible travel time, hence the user is compromised.

andread - D is the answer.

1hr travel time to Italy? lol. Definitely D, ANDREAD.