Questão 50 — CompTIA SY0-701 CompTIA Security+ Certification Exam

Explanation: Correct answer: D. The user's credentials are compromised and are being used by an attacker. This activity most likely indicates compromised credentials. Access from multiple countries within a 30-minute period is an impossible-travel indicator because a legitimate user cannot physically authenticate from geographically distant locations in such a short time. Since the user confirms they were at the office, the most likely explanation is that an attacker has obtained and is using the user's credentials. A scheduled automation tool would normally authenticate from predictable systems or service accounts, not multiple countries. VPN endpoint cycling is possible, but it is weaker because the activity involves access to internal servers and the user denies the behavior. Shared credentials would still be a security violation, but the best operational conclusion is credential compromise requiring containment, password reset, session revocation, and MFA review.