A security administrator received an alert for a user account with the following log activity:
Which of the following best describes the trigger for the alert the administrator received?
A security administrator received an alert for a user account with the following log activity:
Which of the following best describes the trigger for the alert the administrator received?
The alert was likely triggered due to 'Impossible travel time.' The log activity shows multiple log-ins for the same user account from the US and then shortly after from Austria. It is physically impossible for someone to travel between these locations within the short time frame indicated in the logs. Therefore, the system likely flagged this as suspicious activity, triggering the alert.
alright so i had to look it up. AT is Austria
Thanks I was wondering lol.
impossible travel time
C. Impossible travel time The log activity shows multiple log entries for the same user account with log-in times that suggest impossible travel between locations. Specifically, the log shows the user logging in from the US (187.45.32.110), then immediately logging in from Austria (210.167.76.13) within a short period of time. This scenario suggests that the user could not have physically traveled from the US to Austria in the time between log-in events.
Impossible travel time
Impossible travel time
I think it should be impossible travel time. If you look at time column, it shows that user accessed the system from the US and 4 min later they accessed it from Austria which is impossible. Impossible Travel Time: This is a security feature used by cloud providers such as Microsof with their Ofce 365 package to prevent fraud. If a person is located in Toronto and then 30 minutes later is deemed to be in Las Vegas, their attempt to log in will be blocked.
Wrong sub
C. Impossible Travel Time should be the answer. A person cannot be in the US and then literally a few minutes later attempting to login from another country.
Is the answer C ?
This is one of those questions where they don't give you enough information to really know. Geolocation could flag if it's coming from a country that's not allowed. But that would also be impossible travel time since he logged in a few minutes earlier.
Correct Answer: C. Impossible travel time is the best answer because it directly relates to the suspicious activity pattern shown — logging in from vastly distant locations within a timeframe that defies physical travel possibilities. This security feature is designed to detect when logins from different geographic locations occur within a timeframe that would be impossible by ordinary travel means, indicating potential account compromise.
B - Impossible time travel requires user access from two or more geographic separated locations and this example is only 1. Geolocation detect unusual login location like this example.
There are two locations, US and Austria.
I think is geolocation, becuase the ip,s are different so are different users. I dont see any reason why it could not be A either
Number of failed login attempts, why ? Because nothing in the question suggests it's thesame user attempting to login. First 4 login attempts were exactly thesame except for login times. 4 login attempts came from 187.45.32.110 in the USA with same userID, but only 1 successful login attempt came from 210.167.76.13 from AT (Wherever that is, but not USA), in conclusion, I am tempted to conclude that it's not the same user attempting to login, so I will safely go for A - too many login attempts.
A security administrator received an alert for a user account with the following log activity: Sorry, question actually mention "a user account" ie one user account : So, I'll change my answer to B Geolocation. Sorry for the confusion.
*mentioned ......