An analyst sees a successful city VPN login from headquarters, then another success from overseas minutes later for the same user. Which identity anomaly indicator should be treated as suspicious?
Select an answer to reveal the explanation.
Short Explanation
Nobody teleports from city hall to another continent between coffee sips. Impossible-travel alerts mean the account or session is probably in two places—or stolen—so treat it as a compromise signal.
Full Explanation
Impossible-travel detections flag authentication events that cannot reasonably occur given geography and time, often indicating credential theft or session misuse. Load-balanced websites, local ticket renewals, and planned concentrator patching are not identity anomalies of that type.