A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

Ignore the alert because the login eventually succeeded.

A successful login does not rule out compromise when the user denies access. Ignoring the alert would leave a potentially active threat unaddressed.

Reset the password only and close the alert.

A password reset may be needed, but closing the alert without investigation is too early. The source, scope, and any additional compromise indicators still need review.

Reboot the user's laptop to clear any malicious activity.

Rebooting a device does not address suspicious account activity and may destroy useful evidence. The login occurred at the account level, so containment and investigation are more appropriate.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Temporarily disable the account and open an incident for investigation. — When a user denies a login and the SIEM shows unusual success after repeated failures, the safest first step is to contain the account. Temporarily disabling it reduces the chance of further misuse while analysts confirm whether the event was a legitimate login, credential theft, or MFA abuse. This approach balances quick protection with evidence-based investigation and is a standard triage action. Why others are wrong: Ignoring the alert leaves a potentially compromised account active. Resetting the password alone may help later, but it does not immediately stop ongoing misuse or confirm what happened. Rebooting the user's laptop is not relevant to an account-based alert and can destroy useful data if the endpoint is actually involved.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.