SY0-701 Security Operations Practice Question

• ✓ A.Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.
• ✓ B.Correlate the source IP with corporate VPN, CASB, or known cloud egress ranges.
• C.Immediately disable the SaaS platform for every user until the investigation is finished.
• D.Reimage the user’s laptop immediately to remove any possible malware.
• E.Delete the failed login records to reduce noise in the SIEM.

Why A: Option A is correct because reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

• A.Disable the account immediately without checking any other logs.
• ✓ B.Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.
• C.Delete the alert because MFA was enabled and the login eventually succeeded.
• D.Reimage the user's laptop to remove any possible malware right away.

Why B: Option B is correct because the alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

• ✓ A.The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.
• B.The office printer logs to see whether the user printed the mailbox rules.
• C.The antivirus signature version on the user’s laptop only.
• D.The DNS cache on the user’s laptop to find the forwarding rule target.

Why A: Option A is correct because the SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.