SY0-701 Security Operations Practice Question
A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?
⚠ Common exam trap
The trap here is that candidates mistakenly equate valid authentication with legitimate activity, ignoring the strong circumstantial evidence of impossible travel and unauthorized rule creation that clearly indicates compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
True positive indicating likely account compromise and unauthorized mailbox abuse.
The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
False positive caused by normal mailbox synchronization behavior across devices.
Why it's wrong here
Normal mailbox synchronization across devices can produce multiple sign-ins and message duplication, but it does not generate an external forwarding rule or delete an alert email. A new server-side rule to forward mail to an external address is a classic persistence or exfiltration technique, not a sync artifact. Additionally, impossible travel between distant network locations is a well-known anomaly indicator. Thus this is a true positive, not a false positive.
- ✓
True positive indicating likely account compromise and unauthorized mailbox abuse.
Why this is correct
The sequence of impossible travel, an unexpected sign-in source, and creation of an external forwarding rule strongly indicates unauthorized access. Deleting the alert email suggests the attacker is trying to hide evidence. The most likely conclusion is that the account is compromised and requires immediate response actions.
- ✗
Benign activity because the user successfully authenticated with valid credentials and no malware was detected.
Why it's wrong here
Successful authentication with valid credentials does not prove the session is benign, because the credentials may have been stolen through phishing or credential stuffing. The absence of malware is irrelevant when the attacker uses legitimate authentication and then performs malicious post-authentication actions, such as creating a forwarding rule and deleting alerts. Abnormal access patterns and mailbox manipulation are stronger behavioral indicators of compromise than mere credential validity.
- ✗
A denial-of-service event because the attacker is attempting to overwhelm the mail system.
Why it's wrong here
Denial of service would involve overwhelming the mail system with traffic or resource exhaustion, such as flooding the server or consuming mailbox quotas. The observed activities—creating a forwarding rule, deleting an alert email, and accessing from an unexpected network—are classic account misuse and persistence behaviors, not attempts to disrupt availability. Therefore, this is not a DoS event but rather an account takeover with unauthorized mailbox abuse.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.
easy- ✓ A.Repeated failed logins followed by a successful login from the same source IP.
- B.The user authenticated during normal business hours.
- ✓ C.A new inbox forwarding rule sends mail to an external address.
- D.The user accessed email from a corporate laptop.
- E.The password age is 89 days.
Why A: A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.