SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Increase the account lockout threshold to a lower number

  Why it's wrong here

  Lowering the account lockout threshold (i.e., locking accounts after fewer failures) actually makes the situation worse for a password-spraying attack. Because the attacker rotates across many usernames, each individual account receives only one or two attempts, so it will never hit a lockout threshold, while legitimate users may get locked out after mistyping a password a couple of times — creating a self-inflicted denial of service. This approach fails to address the source IP from which the attack originates and shifts the burden to the user rather than the attacker. The correct mitigation is to throttle attempts at the source IP level so that many tries from one IP are progressively blocked, regardless of which username is targeted.

  When this WOULD be correct

  If the question described a brute-force attack using a single username (e.g., 'admin') with many attempts, then lowering the lockout threshold (e.g., from 5 to 3) would lock the account sooner and reduce successful breaches.

• ✗

  Implement geofencing to block traffic from the attacker's region

  Why it's wrong here

  Geofencing restricts authentication requests based on the source IP's geographic location, but this is easily bypassed by a distributed botnet or by routing traffic through VPNs, proxies, or anonymizing services. It also risks blocking legitimate users who travel or connect through cloud-based identity providers, causing a denial of service for valid accounts. More importantly, geofencing does not address the fundamental behavior of password spraying: the attacker is systematically cycling usernames, so location-based blocking does nothing to reduce the overall volume of authentication attempts or protect against compromised credentials originating from allowed regions.

  When this WOULD be correct

  A company wants to restrict access to a sensitive internal application to only employees within the country's borders. The correct answer would be geofencing if the question specifies that all legitimate users are in a known geographic region and the threat is from external IPs outside that region.

• ✓

  Configure rate limiting per source IP address

  Why this is correct

  Rate limiting on the application or firewall level restricts the number of authentication attempts from a single IP address over a given time period, regardless of the username being tried. This directly counters the attacker's strategy of rotating usernames to bypass account lockout.

• ✗

  Enable detailed failed login attempt logging

  Why it's wrong here

  Enabling detailed failed login attempt logging is a detective control, not a preventive one. It aids post-incident forensic analysis and helps identify patterns, but it does nothing to stop the ongoing brute-force attack. Since the analyst already detected the high volume, adding more verbose logs would only increase storage overhead and log noise without reducing the attacker's ability to continue trying credentials. The key is to deploy a proactive control like rate limiting that actively blocks or throttles repeated attempts.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question