問題文
A hospital SOC gets an alert that a nurse's account read 4,000 patient records in one hour. The SOC needs to decide whether this is unusual for that role before escalating. Which data source answers that question, and why do the others fall short?
選択肢
- The Authentication data model, because a successful login is the precondition for the reads and a login from an unexpected location would explain the volume without requiring the SOC to build any baseline of normal behavior at all.
- The application's own access records over the previous weeks, because the comparison the SOC needs is against how much this role normally reads.
- The Endpoint data model, because the process that made the reads can be identified there together with the count of records that process touched.
- The Network Traffic data model, because 4,000 record reads produce measurable traffic, and an hour of reads on that scale stands out against the ward's usual volume.