Question

Which of the following action is treated as Anomaly while understanding User activity logs?

A User usually at his desk from 7:30 AM to 5:00 PM with an hour break for lunch between 11:30 AM and 1:30 PM, if we see his account active on systems or networks in the middle of the night

B User tend to work primarily with unescalated privileges, where some may make occasional forays into higher-level access – particularly admins or managers who have various valid reasons to exercise such access.

C User often work with the same set of tools day-in and day-out, punctuated by periodic use of other applications coincident with business, calendar, or reporting cycles

D User usually show up for work around the same time each day and leave to go home around the same time each night

Practice Next