SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Geofencing

  Why it's wrong here

  Geofencing enforces access decisions by comparing the source IP address's geolocation against a static allow/deny boundary, either blocking or permitting the login attempt at that instant. It does not store or analyze historical login patterns, so the preceding failed attempts are completely irrelevant to its decision. Moreover, geofencing can be easily bypassed through VPNs, proxy servers, or cloud-based remote desktops that make an attacker's traffic appear to originate from an allowed region, leaving the anomalous behavior entirely undetected.

  When this WOULD be correct

  A company wants to prevent any login attempts from specific high-risk countries, regardless of user behavior. The analyst needs a control that blocks access based on geographic location alone. Geofencing would be the correct answer.

• ✗

  Account lockout policy

  Why it's wrong here

  Account lockout policies are a preventive control that increments an authentication-failure counter and disables the account after a fixed threshold, such as five failed attempts. They have no awareness of a subsequent successful login unless the account is actually locked, and attackers can frequently evade the threshold by spacing out their attempts over a long period. Because the policy lacks any concept of geographic origin or event sequencing, a successful login from a new country after a burst of failures will appear perfectly normal once valid credentials are supplied.

  When this WOULD be correct

  An account lockout policy would be the correct answer for a question asking: 'Which control should be implemented to prevent brute-force attacks on user accounts by disabling the account after a specified number of failed login attempts?'

• ✓

  User Behavior Analytics (UBA)

  Why this is correct

  UBA establishes baselines of normal user activity and uses analytics to detect anomalies such as a series of failed logins followed by a successful login from a new geographic region. It is designed to identify suspicious behavioral patterns that other controls might miss.

• ✗

  SIEM correlation rules

  Why it's wrong here

  SIEM correlation rules can combine events from multiple sources, but they rely on predefined logic. While they could be configured to detect this pattern, they are less adaptable to novel or subtle anomalies than UBA, which uses behavioral baselines and machine learning.

  When this WOULD be correct

  A question asks: 'A security team needs to correlate logs from multiple sources to detect a known attack pattern involving multiple failed logins followed by a successful login from the same IP. Which control should be used?' In that case, SIEM correlation rules would be correct because the pattern is known and can be defined.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”