Which indicators might prompt an investigator to scrutinize a connection further?

• A. Connection during weekends, Unencrypted data transmission
• B. Connection late at night, Multiple connections from different areas
• C. Synchronized logins, Regular hour access
• D. High bandwidth usage, No error messages

Answer: (B)

The rationale for this choice being the correct answer hinges on the nature of suspicious activity that typically requires further investigation. A connection late at night is often considered atypical for legitimate business operations. If most users access systems during regular working hours, activities occurring during the night may suggest an unauthorized user or malicious activity.

Additionally, multiple connections from different geographical areas can indicate potentially compromised accounts or coordinated attacks, as it is unusual for one user to be logging in from several different locations in a short period of time. Such patterns trigger red flags for investigators, prompting them to delve deeper into user activity and investigate the integrity of those connections.

In contrast, the other scenarios present indicators that are either too vague or commonly accepted as regular operational behavior. For example, synchronized logins during regular hours might signify normal user activity and could be part of a scheduled process rather than an anomaly. High bandwidth usage on its own doesn’t necessarily indicate malicious intent without additional context, as it could simply reflect legitimate increased usage.