SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The user's account is compromised

  Why this is correct

  In Sentinel UEBA, this alert likely combines an impossible-travel event (source IP geolocation far from the user's normal base) with a mass-download anomaly such as copying hundreds of sensitive files from SharePoint Online or OneDrive within minutes. Because the location shift coincides with a sudden spike in data access that does not match the user's established behavioral baseline, the most probable scenario is an attacker using stolen credentials. UEBA also assigns a high risk score when the anomalous activity targets sensitive data categories, and the combination of geographic and volumetric deviations strongly indicates account compromise rather than benign behavior.

• ✗

  The alert is a false positive due to user travel

  Why it's wrong here

  A false positive from travel would explain only the location-based anomaly, not the simultaneous mass download of sensitive files. During legitimate travel, users may log in from a new IP or country but do not typically enumerate and download entire document libraries or databases, especially at non-standard times. Sentinel UEBA's 'impossible travel' detection also considers the time differential between two sign-ins, so if the account signed in at the home office and then in a distant country within minutes, even genuine travel cannot account for that. Therefore, the data-exfiltration signal disproves the simple travel false positive.

• ✗

  The user is an insider threat

  Why it's wrong here

  While insider threat remains a theoretical possibility, the sudden deviation from the user's established behavior—particularly the anomalous geo-location—points more strongly to external credential compromise than to a malicious internal actor. A true insider would more likely operate from a known corporate network, using their own endpoint, and would not need to bypass normal access patterns with a different country source IP. UEBA's baseline includes not just what files the user accesses but also how, when, and from where, so an insider acting on their own account would rarely produce the same impossible-travel signal. Thus, without additional context like motive or a history of grievances, compromise is the higher-probability hypothesis.

• ✗

  The user is conducting a ransomware attack

  Why it's wrong here

  A ransomware attack typically manifests as a cascade of file encryption operations—renaming files, writing encrypted versions, deleting shadow copies, and dropping a ransom note—not as a single-phase mass download of existing documents. Sentinel UEBA would generate this alert on data access and exfiltration patterns, and ransomware's destructive file modifications would appear as different event types, such as file content changes and deletion of volume shadow snapshots. Moreover, an attacker conducting ransomware would more likely use C2 activity and encryption, whereas this alert's focus on anomalous location and sensitive-data access is characteristic of a data thief using compromised credentials. Therefore, classifying the alert as ransomware is not supported by the described telemetry.

Go deeper

Related to this question