An Employee Who Often Travels Abroad Logs in from a First-Seen

question 5

Multiple Choice

An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)

• A) domain belongs to a competitor
• B) log in during non-working hours
• C) email forwarding to an external domain
• D) log in from a first-seen country
• E) increased number of sent mails

---

Definitions:

Lemmatization

Content analysis procedure for grouping words according to a common dictionary definition.

Dictionary Definition

The meaning of a word or phrase as explained in a dictionary, providing a standard interpretation.

Content Analysis

A research technique for the objective, systematic, and quantitative analysis of communication content.

Coding Scheme

A structured set of codes used to standardize the classification of information, facilitating consistent data analysis across different datasets.