Courseiva

CISA

Full exam simulation

4:00:00
1
medium

Refer to the exhibit. An auditor reviews the security log of a sensitive server. Which of the following is the MOST suspicious event?

Exhibit

Refer to the exhibit.

```
Event Viewer: Security Log
Event ID: 4624 (Successful Logon)
Account Name: jdoe
Logon Type: 3 (Network)
Source Network Address: 10.0.0.15
Workstation Name: WS-FINANCE
Logon Process: NtLmSsp
Authentication Package: NTLM

Event ID: 4624 (Successful Logon)
Account Name: jdoe
Logon Type: 10 (Remote Interactive)
Source Network Address: 192.168.10.50
Logon Process: User32
Authentication Package: Negotiate

Event ID: 4634 (Logoff)
Account Name: jdoe
Logon Time: 2020-06-01 23:45:12
```
0 of 150 answered