A system administrator reviews the following log entries:
User: jsmith | 1:10 PM | Accessed email
User: jsmith | 2:45 AM | Accessed payroll.xlsx
User: jsmith | 2:47 AM | Copied payroll.xlsx
Which activity is the strongest indicator of suspicious behavior?
A cybersecurity analyst notices a user accessing files from a new country at an unusual time. What makes this suspicious?
A honeypot file named “credit_cards.txt” is accessed by a user. Why is this a strong indicator of malicious activity?
A company uses honeypots to detect attackers. What is the main purpose of a honeypot?
A file is hashed and produces the same hash value every time it is checked. What does this indicate?
A file originally has a hash of ABC123. Later, its hash is DEF456. What is the most likely explanation?
A student claims that if two files look identical, they must have the same contents. Why is hashing more reliable than visual inspection?
Which situation best demonstrates suspicious activity based on access logs?
A cybersecurity analyst sees the following:
User: rpatel | 3:00 PM | Accessed project.docx
User: rpatel | 3:05 PM | Logged out
Why is this activity likely not suspicious?
A company records the hash of a file today and compares it to the hash of the same file next week. Why do they do this?
A user runs the command “sha256sum data.csv” twice and gets different results. What should they conclude?
Which of the following best describes a cryptographic hash function?
A system shows no unusual login times or locations, but a file’s hash has changed. What does this suggest?
Which of the following is an example of suspicious behavior based on user patterns?
A honeypot file is never accessed. What can be concluded?
Which command would generate a SHA256 hash on a Windows system?
A user argues that accessing a honeypot file could be normal behavior. Why is this incorrect?
A company notices a user copying large amounts of sensitive data. Why is this considered suspicious?
Which situation provides the strongest evidence that an attack has occurred?
A file’s hash remains the same before and after being shared with another user. What does this indicate?