medium
Single Answer
0Under what circumstances are concurrent sessions most commonly considered indicators of compromise?
Answer Options
A
When they occur on the same system
B
When they occur on two different systems issued to the same user
C
When they occur in two different locations at the same time
D
When they occur in the same location at the same time
Correct Answer: C
Explanation
Concurrent sessions can be relatively common in some applications, so additional data is important when assessing if the event is an IoC. If the event occurs in two different locations, particularly if travel between them would be classified as impossible travel it would more likely be an indicator of compromise or misuse.