Q2Fundamentals
Refer to the exhibit. An engineer is investigating a case involving suspicious usernames in Active Directory. After investigating and cross-correlating events from other sources, the engineer determines that the two users are privileged and that their creation date matches suspicious network traffic initiated from the internal network 2 days earlier. Which type of compromise is taking place?
← → navigate · a answer
Community votes
Discussion · 2
1
Compromised insider - ChatGPT
D 1
Selected Answer: D
The creation of privileged user accounts in Active Directory that lines up with suspicious network traffic points to a network compromise. This kind of activity is often a sign of an attacker obtaining enough access to create accounts with elevated privileges, which can then be used for additional malicious actions inside the network. Cross-correlating events from other sources that match the timing of these account creations further supports the conclusion of a compromised network. This situation is consistent with attacker tactics used to maintain persistence and gain control over network resources for ongoing exploitation1.