A SIEM alert shows that a single user account authenticated to the corporate SaaS suite from New York at 09:02 and from Singapore at 09:11. The New York session was logged off at 09:05, and the company does not use a VPN or proxy that would relay traffic through Asia. Which indicator of compromise does this activity represent?
Select an answer to reveal the explanation.
Short Explanation
Nobody gets from New York to Singapore in nine minutes, not even with a great travel agent. When the same account shows up on two continents faster than physics allows, you're looking at impossible travel. Watch the concurrent-sessions trap; the first session had already ended.
Full Explanation
Impossible travel is an indicator of compromise raised when successful authentications for the same identity occur from locations so far apart that no person could physically move between them in the elapsed time. Here two sign-ins nine minutes apart from New York and Singapore, with no corporate VPN or proxy to explain the geography, strongly suggest the credentials or session are being used by someone other than the legitimate user. Concurrent sessions is a different indicator that requires two sessions to be active at the same time; the New York session ended before the Singapore sign-in, so that condition is not met. Account lockout results from repeated failed attempts exceeding a threshold, but both events in this scenario were successful authentications. Log manipulation involves deleting, altering, or gapping records to conceal activity; nothing suggests the records are tampered with, and the indicator here comes from the records being intact and consistent. Exam caveat: legitimate causes such as VPN egress points or cloud proxies can produce false positives, which is why the stem rules them out. Operational check: confirm with the user, revoke active sessions and tokens, force a password reset with MFA re-registration review, and examine the Singapore session's activity for data access.