SY0-701 Security Operations Practice Question
A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?
⚠ Common exam trap
The trap here is that candidates may focus on the 'successful login' as a resolution rather than recognizing it as the point of compromise, leading them to incorrectly choose A or C instead of prioritizing containment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Temporarily disable the account and open an incident for investigation.
The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the alert because the login eventually succeeded.
Why it's wrong here
A successful login after multiple failed attempts does not negate the fact that the authentication pattern matches a brute-force or password-spraying attack. Since the user explicitly denies the access, the eventual success is a strong indicator of account takeover, not a benign password mistake. Ignoring the alert leaves the attacker with an active, authenticated session and gives them time to move laterally or exfiltrate data. The alert must be treated as a potential compromise until proven otherwise.
- ✓
Temporarily disable the account and open an incident for investigation.
Why this is correct
Disabling the account immediately limits further unauthorized access while the team investigates. Because the user denies the login and the activity is unusual, the account should be contained quickly and the event escalated for incident handling.
- ✗
Reset the password only and close the alert.
Why it's wrong here
Resetting the password alone is insufficient because it does not revoke any existing session tokens or refresh tokens that the attacker may already hold, allowing continued access to cloud resources. Additionally, closing the alert without investigating the source IP, user agent, or subsequent activity forfeits the opportunity to identify the attack vector and scope of compromise. A password reset may be part of the remediation, but containment—such as disabling the account—and incident escalation are required before closing. Premature closure also violates standard incident response procedures and undermines future detection improvements.
- ✗
Reboot the user's laptop to clear any malicious activity.
Why it's wrong here
Rebooting the laptop would clear volatile memory but does not address the attacker’s likely persistence via a compromised Microsoft Entra ID session token or cloud-based credential theft, which persists across reboots. This action is tempting because it effectively terminates active malware on a local machine, making it correct if the alert indicated a local privilege escalation exploit rather than a remote cloud authentication anomaly.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.