SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam

Access More Questions

A SIEM alert fires for a successful authentication to an admin console from a known-clean internal IP at 2:14 AM on a weekend. The user account belongs to a software developer with no admin privileges. Which verdict is most appropriate?

False Positive — admin logins during off-hours are expected Informational — log the event and take no further action Benign True Positive — developer needed emergency access True Positive — credential compromise or unauthorized access is highly probable

Correct Answer:

True Positive — credential compromise or unauthorized access is highly probable

Access more questions from this quiz

Continue to SAL1 Practice Questions - TryHackMe Security Analyst Level 1 (SAL1) Exam for more practice questions and the full quiz experience.

Access More Questions