CompTIA Security+ (SY0-701) SY0-701 — Question 608

A security analyst is reviewing the following logs about a suspicious activity alert for a user's VPN log-ins: Which of the following malicious activity indicators triggered the alert?