SY0-701 Security Operations Practice Question
A SIEM correlates three failed MFA prompts for a payroll admin account from one IP, a successful login two minutes later from the same IP, and a new mailbox forwarding rule to an external address. What is the best immediate action?
⚠ Common exam trap
CompTIA often tests the misconception that deleting the malicious artifact (forwarding rule) is sufficient, when in reality the priority is to contain the compromised account by disabling it and revoking all sessions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the account and revoke active sessions and tokens.
The combination of failed MFA prompts followed by a successful login and immediate creation of an external mailbox forwarding rule is a classic indicator of account compromise (e.g., adversary-in-the-middle or token theft). Disabling the account and revoking active sessions and tokens stops the attacker from maintaining access and prevents further data exfiltration via the forwarding rule, which is the most urgent containment step in incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reset the password and leave the account enabled so the user can keep working.
Why it's wrong here
A password reset alone does not invalidate active sessions, OAuth tokens, or existing mailbox rules that the attacker may have created. Because the account remains enabled, any already-established attacker session continues to operate, allowing further mailbox manipulation or data access. This action addresses credentials without containing the broader compromise, so it fails as an immediate containment step.
- ✓
Disable the account and revoke active sessions and tokens.
Why this is correct
This is the best immediate containment step because the signs strongly indicate account compromise. Disabling the account stops new authentication, while revoking sessions and tokens cuts off any already-established access that could continue to act as the user. That combination contains the incident quickly and limits further mailbox manipulation, data theft, or privilege misuse while the team investigates logs and confirms scope.
- ✗
Delete the forwarding rule and monitor the account for a few hours.
Why it's wrong here
Deleting the forwarding rule removes only a visible symptom, not the attacker's underlying access. Without revoking sessions and tokens, the attacker can simply recreate the rule or abuse other mechanisms like client-side rules or delegated access, and monitoring alone is a passive posture that gives the attacker time to cause more damage. This approach leaves the root compromise unresolved.
- ✗
Wait for the user to confirm the login before taking any action.
Why it's wrong here
Waiting for user confirmation delays containment while the SIEM logs already show suspicious behavior — multiple failed MFA prompts combined with mailbox tampering — which is a strong indicator of compromise. User confirmation is subject to human error and cannot verify the presence of hidden token access, so the attacker gains additional time to escalate privileges or exfiltrate data. The priority in incident response is immediate containment, not confirmation.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?
easy- A.Ignore the alert because the login eventually succeeded.
- ✓ B.Temporarily disable the account and open an incident for investigation.
- C.Reset the password only and close the alert.
- D.Reboot the user's laptop to clear any malicious activity.
Why B: The alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.