Question

A SOC analyst receives an alert that a large volume of files from the company's SaaS-based file-sharing platform was downloaded and then shared externally by a single user account over a two-hour window. The security team suspects data exfiltration. Which action should the analyst take FIRST to investigate this potential cloud data loss event?

Accepted Answer

Review the CASB and SaaS platform audit logs to establish which files were accessed, the source IP, and the sharing scope

Answer

Immediately disable the user account and reimage the user's endpoint to eradicate any malware

Answer

Notify affected customers and regulators that a confirmed data breach has occurred

Answer

Deploy a DLP policy to block all external sharing across the entire organization