A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

The account was probably being used normally because the password was changed

Normal password changes do not usually produce many rapid failures followed by success from the same source.

The SIEM is misconfigured because all failed logons are false positives

Failed logons are valid security events; the sequence can be suspicious even if some failures are legitimate.

The account is definitely malicious and should be deleted immediately

The pattern is suspicious, but confirmation and scope checking should happen before destructive account actions.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: The pattern may indicate password guessing or credential stuffing — The pattern may indicate password guessing or credential stuffing. A burst of failed logons followed by a success from the same IP is a common sign that someone is trying multiple passwords until one works. This does not prove compromise by itself, but it is a strong signal that the account should be reviewed, the source investigated, and related logs correlated to determine whether the login was legitimate. Why others are wrong: A normal password change does not usually create this exact pattern from the same source. The SIEM is not necessarily misconfigured; the alert is based on a meaningful behavioral pattern. Deleting the account immediately is too aggressive without confirmation and may disrupt business if the login was legitimate. Investigation should come before irreversible action.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.