SY0-701 Security Operations Practice Question
A security analyst notices repeated failed login attempts to a critical database server from a single external IP address over the past hour. The analyst reviews the authentication logs and sees that the account name used in each attempt is 'admin'. Which of the following security controls should the analyst recommend to mitigate this type of attack with minimal impact on legitimate users?
⚠ Common exam trap
It's easy for candidates to choose account lockout policies (Option A) because they seem like a direct countermeasure to failed logins, but they fail to recognize that locking a critical shared account like 'admin' can cause a denial of service for legitimate users, whereas blocking the source IP is a more targeted and less disruptive control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a temporary block rule on the perimeter firewall for the source IP address.
Implementing a temporary block rule on the perimeter firewall for the source IP address directly stops the attack at the network boundary, preventing further authentication attempts without affecting legitimate users who are not using that IP. This approach is a form of dynamic IP blocking, which is a common mitigation for brute-force attacks targeting a single account from a specific external source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an account lockout policy to lock the 'admin' account after three failed attempts.
Why it's wrong here
An account lockout policy on a critical database server could lock out legitimate administrators if they accidentally mistype credentials, and it may not prevent the attacker from moving to other target accounts. This option is incorrect because it negatively impacts availability and does not address the source IP.
When this WOULD be correct
This option would be correct if the question described a brute-force attack targeting multiple user accounts from various IP addresses, where locking accounts after a few attempts prevents credential guessing without affecting a single IP.
- ✓
Implement a temporary block rule on the perimeter firewall for the source IP address.
Why this is correct
Blocking the attacking IP at the firewall immediately halts the malicious traffic without affecting other users or accounts. This is a quick, low-impact containment measure that can be reversed if false positive, making it the best immediate response.
- ✗
Disable the 'admin' account until the source IP can be investigated.
Why it's wrong here
Disabling the 'admin' account is an account-centric response that fails to stop the attack traffic from reaching the server; the brute-force attempts will continue, merely returning authentication failures. More importantly, this account is likely a privileged service or emergency account, so disabling it can break automated processes, lock out other administrators, and violate availability requirements. Because the malicious activity originates from a specific source IP, the correct containment is to block that IP at the perimeter firewall, preserving the account's legitimate use while cutting off the attacker. This option is therefore overly aggressive, operationally risky, and does not remediate the actual network-level threat.
When this WOULD be correct
If the question described an internal brute-force attack targeting a single privileged account from multiple internal IPs, and the organization could afford temporary downtime for that account while investigating a suspected compromise, disabling the account would be a valid containment step.
- ✗
Require multi-factor authentication on the 'admin' account for all remote logins.
Why it's wrong here
While MFA strengthens authentication, it does not stop the current attack because the attempts are still hitting the server and using up processing resources. Also, MFA may not be supported by all legacy systems or could be bypassed. It is a good preventive control but not the best immediate mitigation.
When this WOULD be correct
In a scenario where an attacker has successfully guessed a password and is attempting to log in remotely, and the goal is to prevent unauthorized access even if credentials are compromised, requiring MFA for all remote logins would be the correct recommendation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Implement a temporary block rule on the perimeter firewall for the source IP address.Correct answer▾
Why this is correct
Blocking the attacking IP at the firewall immediately halts the malicious traffic without affecting other users or accounts. This is a quick, low-impact containment measure that can be reversed if false positive, making it the best immediate response.
✗Configure an account lockout policy to lock the 'admin' account after three failed attempts.Wrong answer — click to see why▾
Why this is wrong here
An account lockout policy would lock the 'admin' account after three failed attempts, but the attacker is using a single external IP and can simply wait for the lockout to expire or use a different account. This does not prevent the attack from the same IP and could lock out legitimate admins.
★ When this WOULD be the correct answer
This option would be correct if the question described a brute-force attack targeting multiple user accounts from various IP addresses, where locking accounts after a few attempts prevents credential guessing without affecting a single IP.
Why candidates choose this
Candidates often think account lockout is a standard defense against brute-force attacks, but they overlook that the attack is from a single IP targeting a single account, making IP blocking more effective and less disruptive.
✗Disable the 'admin' account until the source IP can be investigated.Wrong answer — click to see why▾
Why this is wrong here
Disabling the 'admin' account would prevent legitimate administrative access entirely, causing significant operational disruption, and does not address the external IP source of the attack, which could simply switch to another account name.
★ When this WOULD be the correct answer
If the question described an internal brute-force attack targeting a single privileged account from multiple internal IPs, and the organization could afford temporary downtime for that account while investigating a suspected compromise, disabling the account would be a valid containment step.
Why candidates choose this
Candidates may think disabling the targeted account is a quick way to stop the attack, overlooking that it blocks all legitimate use and fails to address the external IP vector, which could be blocked more precisely.
✗Require multi-factor authentication on the 'admin' account for all remote logins.Wrong answer — click to see why▾
Why this is wrong here
While MFA adds security, it does not prevent the repeated failed login attempts from a single IP; the attack is already occurring and MFA would not stop the brute-force attempts themselves, only add a second factor if the password were guessed. The question asks to mitigate the attack with minimal impact on legitimate users, and MFA does not address the source IP or the ongoing attempts.
★ When this WOULD be the correct answer
In a scenario where an attacker has successfully guessed a password and is attempting to log in remotely, and the goal is to prevent unauthorized access even if credentials are compromised, requiring MFA for all remote logins would be the correct recommendation.
Why candidates choose this
Candidates may think MFA is a universal solution for authentication attacks, overlooking that the immediate issue is the brute-force attempt from a single IP, which is better addressed by blocking that IP.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.