SY0-701 Security Operations Practice Question
A SIEM alert shows 120 failed logins for one user account from three different countries within 10 minutes, followed by a successful login. What should the analyst do first?
⚠ Common exam trap
Many candidates assume a successful login after failures means the attack succeeded and jump to containment (Option C or D), but the SY0-701 emphasizes that verification with the user and additional logs is the mandatory first step in the incident response process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the activity with related logs and check whether the account owner confirms the login.
The analyst must first validate the alert by correlating the SIEM data with additional logs (e.g., authentication logs, firewall logs) and contacting the account owner to confirm whether the successful login was legitimate. This follows the incident response process of verification before action, preventing unnecessary disruption if the activity is benign (e.g., the user traveling with VPN).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Close the alert because the login eventually succeeded.
Why it's wrong here
Closing the alert solely because the login eventually succeeded is premature: the successful authentication may have been the attacker's final guess after a brute-force or password-spraying attack, or the legitimate user's subsequent login after an attacker's failed attempts. This outcome does not rule out account compromise or policy violations, and dismissing the alert without correlating related authentication logs, source IPs, and timestamps would leave a potential security incident uninvestigated. Proper triage requires validating the alert, not assuming success negates preceding suspicious activity.
- ✓
Verify the activity with related logs and check whether the account owner confirms the login.
Why this is correct
The correct first step in alert triage is to validate the alert by correlating related logs—such as authentication servers, VPN gateways, and endpoint activity—to determine the source IPs, geolocation, time patterns, and whether the failures were followed by a success from the same or different origin. Simultaneously, contacting the account owner confirms whether they initiated the logins, which distinguishes a legitimate user's forgotten password from a malicious brute-force attempt. This verification process ensures the alert is not a false positive and provides necessary context for deciding on further containment, eradication, or recovery actions.
- ✗
Immediately delete the account to stop further access.
Why it's wrong here
Immediately deleting the account is an excessively destructive and irreversible action that goes beyond temporary containment; it removes the user's directory object, breaks group memberships, and can disrupt dependent services, applications, or scheduled tasks, potentially causing a larger outage. It also destroys forensic evidence such as account activity logs and any files owned by the account, hampering investigation. Instead, the appropriate containment step would be to disable the account or force a password reset after verifying the alert, preserving evidence and business continuity while preventing unauthorized access.
- ✗
Reimage the user's laptop before collecting any information.
Why it's wrong here
Reimaging the user's laptop before collecting any information destroys volatile and non-volatile evidence, including memory contents, prefetch files, browser history, and malware artifacts, all of which could be critical for identifying the root cause and scope of the attack. It also precludes forensic analysis of the endpoint that may reveal lateral movement, persistence mechanisms, or data exfiltration. The proper sequence is to isolate the system, preserve evidence via memory and disk imaging, and only then consider reimaging as a remediation step after investigation—not as an immediate triage action.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?
easy- A.Immediately delete the account to stop any further access attempts.
- ✓ B.Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.
- C.Assume the account is compromised and notify all users to change their passwords.
- D.Close the alert because one successful login means the activity was normal.
Why B: The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.
Variation 2. A SOC analyst sees 20 failed logins for one user account, followed by a successful login 30 seconds later from the same office subnet. The user confirms they mistyped the password several times. What is the best conclusion?
easy- A.It is definitely a brute-force attack and should be treated as confirmed compromise.
- ✓ B.It is most likely a false positive caused by user error and should be documented after verification.
- C.It is evidence of malware on the user's workstation until the device is rebuilt.
- D.It proves the password was changed by an attacker and the account must be disabled immediately.
Why B: The scenario shows 20 failed logins followed by a successful login from the same office subnet, and the user confirms they mistyped the password. This pattern is consistent with user error (e.g., Caps Lock or typo), not an automated brute-force attack, which would typically show a much higher volume of attempts from diverse IPs. The best conclusion is a false positive, which should be documented after verification to maintain accurate incident records.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.