SY0-701 Security Operations Practice Question
A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?
⚠ Common exam trap
The trap here is that candidates may dismiss the alert as a false positive due to a user forgetting their password, but the specific combination of rapid failures followed by success from the same IP is a textbook sign of a successful brute-force or credential stuffing attack, not normal user behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pattern may indicate password guessing or credential stuffing
The pattern of 20 rapid failed authentication attempts followed by a successful authentication from the same source IP is a classic indicator of a password guessing or credential stuffing attack. The attacker likely used a list of common passwords or previously compromised credentials, and the final success suggests they found a valid password. SIEM correlation rules are designed to detect such brute-force or spraying behaviors, and this event warrants immediate investigation to determine if the account is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The account was probably being used normally because the password was changed
Why it's wrong here
A routine password change occurs only after the user has already authenticated successfully, and it rarely involves dozens of rapid failed attempts from the same source IP. In contrast, the alert pattern of many failures immediately followed by a success is the classic footprint of an automated tool iterating through a password list until one matches. Additionally, if the password was changed, it is more likely that the attacker changed it after gaining initial access to lock out the legitimate user, which would make the account even more compromised, not normal.
- ✓
The pattern may indicate password guessing or credential stuffing
Why this is correct
Repeated failed logons from the same account and source, followed by a successful logon, is a well-established signature of password guessing or credential stuffing. The attacker submits a large set of guesses, and when one finally matches, the success logon completes the pattern, indicating that a valid credential has been compromised. This correlation is not definitive proof, but it is a strong indicator that warrants immediate investigation and validation before considering containment or eradication.
- ✗
The SIEM is misconfigured because all failed logons are false positives
Why it's wrong here
Failed logons are legitimate security events; even if individual failures are caused by users typing wrong passwords, the correlation rule is designed to detect an abnormal aggregation of those failures. A sequence of many failures followed by a success is a recognized attack pattern, and dismissing it as a misconfiguration would lead the security team to miss real credential-based attacks. A properly tuned SIEM uses baselines and thresholds to reduce noise, so an alert indicates that the observed behavior exceeded those statistical expectations, not that the SIEM is faulty.
- ✗
The account is definitely malicious and should be deleted immediately
Why it's wrong here
While the pattern is suspicious and worth escalating, it does not prove with certainty that the account is malicious; it could be a legitimate user who triggered a temporary lockout and then reset their password, or a false positive due to an unusual but authorized scenario. Deleting an account immediately is irreversible and can cause data loss or business disruption, and it also destroys forensic evidence that could help trace the attacker's methods or scope of compromise. The appropriate incident-response action is to disable the account temporarily, gather evidence, and inspect for other affected accounts before any destructive steps.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
Credential stuffing
Credential stuffing is a cyberattack where attackers use lists of stolen usernames and passwords to gain unauthorized access to user accounts on different websites.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.