An analyst sees a successful city VPN login from headquarters, then another success from overseas minutes later for the same user. Which identity anomaly indicator should be treated as suspicious?
Select an answer to reveal the explanation.
Short Explanation
Nobody teleports from city hall to another continent between coffee sips. Impossible-travel alerts mean the account or session is probably in two places—or stolen—so treat it as a compromise signal.
Full Explanation
Impossible travel flags authentication or session success from geographically distant locations within a timeframe that normal transit cannot explain. A city VPN login from headquarters followed minutes later by another success overseas for the same user is a strong compromise or shared-session indicator: either credentials/tokens are duplicated or the account is being used concurrently in ways policy forbids. Municipal remote-access programs must treat that anomaly as incident-worthy, not as a curiosity.
Expected dual-homing of a load-balanced public website describes redundant web front ends, not one user’s VPN identity appearing on two continents. Normal Kerberos ticket renewal within the same building is routine intra-site authentication maintenance without geographic impossibility. Scheduled patching of the VPN concentrator during a maintenance window is change management, not an identity geo-anomaly.
Exam caveat: impossible travel is an identity detection concept; it does not prove which device was stolen, only that the account/session behavior is inconsistent with one traveler. Time zone, VPN egress, and mobile users can create false positives—exam answers still treat the pattern as suspicious by default.
Operational check: disable or step-up MFA challenge the account, revoke active VPN sessions and refresh tokens, contact the employee through an out-of-band channel, review source IPs and device posture for both logins, and check whether the overseas success used a stolen cookie versus a full password+ MFA path.