SY0-701 Security Operations Practice Question
A SIEM alert shows a payroll administrator account signed in at 02:10 from a country the employee has never visited. The employee says they are on vacation at home and did not travel. What should the analyst do first?
⚠ Common exam trap
The trap here is that candidates may jump to containment (disabling the account) or dismissal (false positive) without performing the critical triage step of verifying the login context, which the exam emphasizes as the first action in the incident response process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the login context with the user or manager and review recent authentication history.
The first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately disable the account and wait for the employee to return.
Why it's wrong here
This is premature containment, not triage. Disabling the account without first validating the alert—such as correlating the sign-in IP, device, and time with the user's normal behavior—may block a legitimate session and cause business disruption. It also violates standard incident response phases (identification before containment), and prevents you from gathering additional log evidence or interviewing the user while the context is still fresh.
- ✓
Verify the login context with the user or manager and review recent authentication history.
Why this is correct
This is the best first step because alert triage should confirm whether the activity is truly suspicious before disruptive action is taken. Reviewing the user’s normal login patterns, recent sign-in history, and whether a VPN or travel exception exists helps distinguish a real compromise from an unusual but legitimate event. Good triage reduces unnecessary outages and focuses response effort appropriately.
- ✗
Close the alert as a false positive because the user is on vacation.
Why it's wrong here
Vacation status alone does not validate the sign-in; it only indicates the legitimate user is not physically at work. An attacker who has obtained the user's credentials through phishing or credential stuffing can sign in from anywhere, and the alert may reflect that malicious activity. You must review the authentication logs for anomalies like impossible travel, impossible login times, or unusual ASN/IP reputation before dismissing it.
- ✗
Reimage the user’s workstation before checking any logs.
Why it's wrong here
Reimaging is a final remediation step, not a first triage action, and it destroys volatile and forensic evidence on the endpoint—including Prefetch files, $UsnJrnl records, browser cache, and memory artifacts—that could reveal the attack vector and scope. Additionally, if the sign-in came from a compromised token, stolen credentials via a VPN, or another endpoint, reimaging the local workstation does not address the root cause and could give a false sense of security.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.