A security operations analyst is tuning a SIEM correlation rule designed to detect brute-force password attacks against domain user accounts. The current rule generates an alert when a single user account has more than 10 failed logon attempts within a 5-minute window. The SOC team is overwhelmed by thousands of alerts each day, the vast majority of which are triggered by legitimate users who accidentally mistype their passwords. Which of the following modifications to the rule would most effectively reduce false positives while still detecting actual brute-force attacks?

Increase the failed attempt threshold to 20 attempts within the same 5-minute window.

Raising the threshold reduces sensitivity but may still generate false positives from fast typists and could allow a true brute-force attack to succeed if the attacker keeps under the new limit.

Modify the rule to trigger only when the failed attempts are against multiple distinct user accounts.

This would detect password spraying attacks (many accounts, one password), not brute-force against a single account. It does not address the false positive issue described.

Add an exception to suppress alerts for any user account that has a valid password reset request within the same time period.

This is unreliable because not all users submit password reset requests, and an attacker could also initiate a reset to evade detection. It does not effectively reduce false positives in a consistent manner.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Modify the rule to trigger only when the failed attempts originate from multiple distinct source IP addresses. — The goal is to distinguish between accidental mistypes (single IP, low volume) and true brute-force attacks (often distributed across multiple IPs). Option B achieves this by requiring the failed attempts to come from multiple distinct source IPs, which is a strong indicator of an automated attack using proxies/botnets. Option A simply raises the threshold, which may miss slower or cautious attackers. Option C targets password spraying (multiple accounts, single password) rather than single-account brute force. Option D is unreliable because users may not submit password reset requests, and it could be bypassed by an attacker who also requests a reset. Therefore, B is the most effective tuning technique.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.