Investigate a suspicious service identity

UTC	Source	Evidence
14:02	Endpoint collector	ENG-17: unsigned helper launches under svc-indexer after an unexpected document process
14:04	Identity audit	svc-indexer obtains a token from unmanaged device 203.0.113.61
14:05	Role audit	svc-indexer adds itself to Research Exporters; initiator 203.0.113.61
14:07	Object audit	Successful reads of 412 restricted objects by svc-indexer
14:08	Proxy summary	203.0.113.61 has no monitored proxy record; collector covers managed workstations only

UTC

Source

Evidence

14:02

Endpoint collector

ENG-17: unsigned helper launches under svc-indexer after an unexpected document process

14:04

Identity audit

svc-indexer obtains a token from unmanaged device 203.0.113.61

14:05

Role audit

svc-indexer adds itself to Research Exporters; initiator 203.0.113.61

14:07

Object audit

Successful reads of 412 restricted objects by svc-indexer

14:08

Proxy summary

203.0.113.61 has no monitored proxy record; collector covers managed workstations only

AI case summary: 'Export did not happen because no proxy alert exists.' Enrichment workflow: fetch identity/device history, attach object-audit evidence, open analyst case. Proposed extra action: disable all service identities automatically whenever the AI labels a case high risk.

multi select

Select the THREE observations that jointly justify treating this identity as compromised.

3 pts

svc-indexer is a service identity rather than a user account There was no monitored proxy alert An unapproved role change was made by the same identity and remote source The identity read restricted objects after gaining the export role The unexpected endpoint process chain used this identity

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

single choice

Which immediate action best follows the supplied authorization and limits disruption?

2 pts

Revoke svc-indexer sessions, isolate ENG-17, and preserve the linked evidence Disable every service identity in the organization Reimage ENG-17 immediately to remove the unsigned helper Wait for an outbound proxy alert before acting

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

What must the analyst correct in the AI-generated conclusion?

2 pts

Discard every machine-generated enrichment result Missing proxy evidence is a visibility gap, not proof that no export occurred Successful object reads prove that every object was exfiltrated The conclusion only needs a higher model confidence score before it is used

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

Which hunt would best test whether the same behavior affected other identities?

2 pts

Search for unexpected privilege changes followed by restricted-object reads from unmanaged devices Search only for the exact fictional workstation name ENG-17 Look up the reputation of 203.0.113.61 in several threat feeds Assign a named threat actor based on one remote address

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

Original practice · Review pending

Inspect the evidence

Normalized event timeline

Automation review

Complete the response

Select the THREE observations that jointly justify treating this identity as compromised.

Which immediate action best follows the supplied authorization and limits disruption?

What must the analyst correct in the AI-generated conclusion?

Which hunt would best test whether the same behavior affected other identities?

Review your result

Attempt history

Question or answer look wrong?