CompTIA CASP+ (CAS-003) — Question 150

A Chief Security Officer (CSO) is reviewing the organization's incident response report from a recent incident. The details of the event indicate:
1. A user received a phishing email that appeared to be a report from the organization's CRM tool.
2. The user attempted to access the CRM tool via a fraudulent web page but was unable to access the tool.
3. The user, unaware of the compromised account, did not report the incident and continued to use the CRM tool with the original credentials.
4. Several weeks later, the user reported anomalous activity within the CRM tool.
5. Following an investigation, it was determined the account was compromised and an attacker in another country has gained access to the CRM tool.
6. Following identification of corrupted data and successful recovery from the incident, a lessons learned activity was to be led by the CSO.
Which of the following would MOST likely have allowed the user to more quickly identify the unauthorized use of credentials by the attacker?

Answer options

• A. Security awareness training
• B. Last login verification
• C. Log correlation
• D. Time-of-check controls
• E. Time-of-use controls
• F. WAYF-based authentication

Correct answer: A

Explanation

Security awareness training would have educated the user about recognizing phishing attempts and understanding the importance of reporting suspicious activity, allowing for earlier detection of unauthorized access. Other options, such as last login verification or log correlation, may help in monitoring access but would not directly empower the user to identify a compromise in their credentials. Time-of-check and time-of-use controls focus on system security rather than user awareness, which is crucial in this scenario.