SY0-701 Security Operations Practice Question
A SIEM analyst reviews the following sequence from a VPN and email platform over 15 minutes: 47 failed logins against different accounts from one public IP, one successful VPN login from that same IP, a new inbox forwarding rule to an external address, and a mailbox sign-in from a device never seen before. Which three findings most strongly support a password-spraying-to-compromise scenario? Select three.
⚠ Common exam trap
Many exam-takers think a single successful login or a forwarding rule alone is suspicious, but the question asks for findings that most strongly support the password-spraying-to-compromise scenario, which requires the combination of the spray pattern, the successful login from the same source, and the post-compromise persistence action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Many failed logins across different usernames from the same source IP in a short time window.
A high volume of failed logins against multiple accounts from a single public IP within a short time window is the hallmark of a password-spraying attack, where the attacker tries a few common passwords across many usernames to avoid account lockout. This pattern is distinct from a brute-force attack, which targets a single account with many passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Many failed logins across different usernames from the same source IP in a short time window.
Why this is correct
This pattern is the hallmark of password spraying, where an attacker tests a small set of common passwords against a large number of accounts to evade account lockout thresholds. The single source IP indicates a coordinated scripted attempt, and the short time window suggests automation. In the MITRE ATT&CK framework, this maps to T1110.003 (Password Spraying) under Initial Access.
- ✓
A successful VPN login from the same source IP after the burst of failures.
Why this is correct
The temporal adjacency transforms the earlier spray from suspicious to critical: one of the guessed credentials was accepted. Successful authentication from the same IP that initiated the failures indicates the attacker now holds a valid account and is establishing a foothold. If MFA is not enforced, this success is the point of initial access and warrants immediate incident response.
- ✓
An inbox forwarding rule sending messages to an external address.
Why this is correct
After gaining mailbox access, attackers often create a rule to forward all inbound email, or specific keywords, to an external address controlled by them. This is a persistence/exfiltration technique that works silently unless the rule is reviewed, and can be detected by comparing the rule creation time to the successful login. In ATT&CK this is T1114.003 (Email Forwarding Rule).
- ✗
A workstation patch installation completed earlier that day.
Why it's wrong here
Patching is routine administrative action and does not explain the authentication failures or the forwarding rule. It is entirely orthogonal to the attack chain; it neither causes the failed logins nor is a symptom of compromise. Therefore it does not contribute to the investigation or corroborate the suspicious pattern.
- ✗
The mailbox server reported normal disk utilization during the same hour.
Why it's wrong here
Normal disk utilization is a health metric and offers no indication of unauthorized authentication or rule creation. An attacker can perform all these activities without affecting disk I/O, so this data point is irrelevant to confirming the incident. It neither corroborates nor refutes the attack and should be ignored in the security investigation.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.