312-39V2: Certified SOC Analyst v2

Question

A financial institution suspects an insider threat after unauthorized attempts to access restricted databases. However, the SIEM alerts do not contain enough information to distinguish legitimate access from malicious access. The SOC manager recommends integrating contextual data to improve detection. Which contextual data source must be integrated in this scenario?

Explanation

User context from HR systems provides employee identity, role, department, employment status, and related authorization context. This lets a SOC correlate database-access attempts with the user’s legitimate responsibilities and identify activity that is inconsistent with authorized access.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ8

Community Discussion