Q2
Single choice
While investigating alerts you notice a user entity has triggered a historical alert for Large Internal Data Download. While investigating the alert, you notice that the download came from a different device than normal for the user.
Based on these conditions, is this a possible cause?
(This is a classic user account take over pattern.)