← Cloud IR — M365, AWS, and Azure Incident Response

Module Quiz

10 questions · Pass at 80%

Question 1 of 10

An M365 UAL query shows UserLoggedIn for jsmith@company.com from IP 185.220.101.9 at 18:30 UTC with MFA successful. At 18:31 UTC, FileDownloaded events begin from the same account from a DIFFERENT IP: 203.0.113.15. What is this most likely?