A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

Immediately block the IP address at the perimeter firewall.

While blocking the malicious IP is a valid containment step, it should not be the first action. The analyst should first determine if any valid accounts were targeted, as a successful logon could have already occurred. Blocking prematurely might also hinder further observation of the attack pattern.

Run a full antivirus scan on the domain controller.

An antivirus scan is not warranted at this point. The logs indicate an authentication attack, not malware activity. Scanning the domain controller would divert resources from addressing the immediate threat and would not prevent the ongoing logon attempts.

Notify the company's legal department for law enforcement involvement.

Legal involvement and reporting to law enforcement may be appropriate later, but it is premature before confirming that the attack is successful or that sensitive data has been accessed. The analyst should first investigate and contain the threat.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Investigate whether any of the attempted accounts correspond to actual domain users. — The pattern of failed logon attempts with random account names from an external IP is indicative of a password spraying or dictionary-based brute-force attack. The primary concern is whether any of the targeted accounts are valid domain users because a successful login could have occurred and might not appear as a failure. Before taking irreversible actions such as blocking the IP or escalating to legal, the analyst should investigate if any valid accounts were attempted, as that could indicate a potential compromise. Running an antivirus scan on the domain controller is not directly relevant to the immediate threat, and notifying legal is premature without more evidence.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.