200-201 Security Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Alert on a single failed login from any IP

  Why it's wrong here

  Alerting on one failed login from any IP generates excessive false positives from mistyped passwords and produces no threshold across attempts. It is tempting because failed authentications are the raw signal for brute force, yet detection requires many failures from one source within a window.

• ✓

  Alert when more than 10 failed logins from the same IP occur within one minute

  Why this is correct

  Counting failed logins per source IP within one minute detects the rapid, repeated authentication attempts from one origin that define brute forcing, filtering out isolated failures. This logic directly identifies the activity the analyst is investigating.

• ✗

  Alert when a successful login occurs after midnight

  Why it's wrong here

  A successful login after midnight is a time-based condition, not a frequency threshold, so it cannot distinguish repeated authentication attempts from ordinary off-hours access. It is tempting because unusual login timing can indicate compromise, which suits anomaly or impossible-travel detection rather than brute force correlation.

• ✗

  Alert when a user logs in from a new geographic location

  Why it's wrong here

  Geographic login anomalies flag impossible travel or credential misuse, not repeated authentication failures. Brute force detection requires counting failed logins per account or source within a window, which this rule never aggregates. It would suit detecting compromised credentials used from an unusual country.

Go deeper

Related to this question