A security analyst notices repeated failed login attempts to a critical database server from a single external IP address over the past hour. The analyst reviews the authentication logs and sees that the account name used in each attempt is 'admin'. Which of the following security controls should the analyst recommend to mitigate this type of attack with minimal impact on legitimate users?

Configure an account lockout policy to lock the 'admin' account after three failed attempts.

An account lockout policy on a critical database server could lock out legitimate administrators if they accidentally mistype credentials, and it may not prevent the attacker from moving to other target accounts. This option is incorrect because it negatively impacts availability and does not address the source IP.

Disable the 'admin' account until the source IP can be investigated.

Disabling the account would prevent all administrative access, potentially disrupting critical operations and causing downtime. It does not address the root cause and may be overly aggressive.

Require multi-factor authentication on the 'admin' account for all remote logins.

While MFA strengthens authentication, it does not stop the current attack because the attempts are still hitting the server and using up processing resources. Also, MFA may not be supported by all legacy systems or could be bypassed. It is a good preventive control but not the best immediate mitigation.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Implement a temporary block rule on the perimeter firewall for the source IP address. — This scenario describes a brute-force or password-spray attempt targeting a common account name ('admin') from a single source. The most effective immediate response is to temporarily block the source IP at the network perimeter (e.g., firewall or IDS/IPS) to stop further attempts without affecting other users. Account lockout (A) would prevent all users from using the 'admin' account, which may be a shared or service account; disabling the account (C) would disrupt legitimate administrative access. Multi-factor authentication (D) is a long-term mitigation but does not stop the current flood of attempts and can be bypassed if the account is compromised via replay attacks on older protocols. Hence, IP-based blocking is the fastest and least disruptive control.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.