Salesforce Certified Slack Administrator free question 8 / 10 · Domain 5: Governance, Security and Compliance
An Enterprise org turns on End user sessions automatically for Excessive downloads. The CISO assumes that an account which sets it off stays locked until security clears the person. What does the anomaly event response page say happens?
- Sessions end on the device used, and other devices stay signed in
- The person is signed out and needs an admin reset to sign in
- The account is deactivated until an Org Owner reactivates it
- Sessions end, and the person can sign back in at once as usual
Show the answer and explanation
Answer: D
Why this is correct
Anomaly events in the audit logs indicate potentially unusual or suspicious user and app activity. The page advises investigating them in general before acting, but lets an org automatically end a user's sessions when an event is detected, to halt the activity. The response ends the user's sessions across all devices for the events selected, such as excessive downloads, potential spam or unexpected API call volume. The key line for the CISO: if a user's sessions end in response to an anomaly event, they can immediately sign back into Slack using their usual login credentials. The response interrupts the activity rather than locking the account, so the security team still has to investigate and, if needed, take further action on the account.
Why the other options are wrong
"The account is deactivated until an Org Owner reactivates it" … The response ends the user's sessions; it does not deactivate the account. The person can sign back in immediately with their usual credentials.
"The person is signed out and needs an admin reset to sign in" … No reset is involved. After the sessions end, the person signs back in using their usual login credentials, right away.
"Sessions end on the device used, and other devices stay signed in" … The response ends a user's sessions across all devices when the selected anomaly event is detected, not only on the device involved.
What an automatic response does
It ends sessions on all devices, and the person can sign back in right away. It halts the activity; it is not a lockout.