A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame.
Which of the following is the MOST likely cause of this issue?
A. A password-spraying attack was performed against the organization.
B. A DDoS attack was performed against the organization.
C. This was normal shift work activity; the SIEM's AI is learning.
D. A credentialed external vulnerability scan was performed.
A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geo
-
answerhappygod
- Site Admin
- Posts: 899604
- Joined: Mon Aug 02, 2021 8:13 am
A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geo
Join a community of subject matter experts. Register for FREE to view solutions, replies, and use search function. Request answer by replying!