A SIEM alert shows 120 failed logins for one user account from three different countries within 10 minutes, followed by a successful login. What should the analyst do first?

Close the alert because the login eventually succeeded.

A successful login after many failures can still indicate account compromise or a password attack.

Immediately delete the account to stop further access.

Deleting the account is an extreme response that can disrupt business and should not be the first action.

Reimage the user's laptop before collecting any information.

Reimaging destroys useful evidence and is not the first step in alert triage or investigation.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Verify the activity with related logs and check whether the account owner confirms the login. — The best first action is to verify the alert by checking related authentication logs and confirming whether the login came from the account owner or an authorized travel scenario. Easy-to-miss alerts often need correlation before escalation. This approach helps the analyst distinguish between a real attack, such as credential stuffing or password spraying, and a legitimate but unusual login pattern. Starting with validation avoids unnecessary disruption while preserving the ability to respond quickly if the activity is malicious. Why others are wrong: Closing the alert without checking evidence assumes the event is harmless. Deleting the account is too aggressive for first response and can interrupt legitimate work. Reimaging a device is an eradication step, not a triage step, and should not happen before confirming what occurred and collecting useful logs.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.