A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Immediately disable the SaaS platform for every user until the investigation is finished.

This is overly disruptive for an initial validation step and would create unnecessary business impact. The alert concerns one account, so broad shutdown is not proportional. Containment may be needed later if compromise is confirmed, but the analyst should first verify the source, device, and authentication context.

Reimage the user’s laptop immediately to remove any possible malware.

Reimaging is a remediation action, not a first validation step for a suspicious cloud login. The event may have originated from credential theft, a trusted VPN, or a temporary travel pattern rather than local malware. Destroying the endpoint state too early can also eliminate evidence that would help determine the true source of access.

Delete the failed login records to reduce noise in the SIEM.

Deleting logs would damage investigation quality and could violate retention requirements. Failed attempts are often valuable evidence of password spraying or credential stuffing. The correct approach is to preserve and correlate those logs, not remove them.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Review the identity provider and MFA logs to confirm the successful login came from the same account and device context. — The best answers are to review the identity provider and MFA logs and to correlate the source IP with trusted organizational egress such as VPN or CASB infrastructure. Together, those steps validate whether the account activity reflects a real compromise or a legitimate access pattern that simply looks unusual in the SIEM. They preserve evidence while the analyst confirms context before moving to containment. Why others are wrong: Broadly disabling the platform or reimaging the laptop is too aggressive before basic validation. Those actions can disrupt operations and destroy evidence. Deleting log records is never appropriate because they are critical for tracing authentication attempts, identifying source patterns, and documenting the incident accurately.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.