SY0-701 Security Operations Practice Question
A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.
⚠ Common exam trap
The SY0-701 exam often tests the concept that a single successful login after failures is not enough—candidates must recognize that the forwarding rule is the second critical indicator, not the timing of the login.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Repeated failed logins followed by a successful login from the same source IP.
A brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Repeated failed logins followed by a successful login from the same source IP.
Why this is correct
Multiple failed attempts from the same source IP indicate a systematic credential attack rather than an accidental lockout. When a successful authentication follows immediately after, it strongly suggests the attacker eventually guessed or sprayed a valid password. This is a classic signature of brute-force or password-spraying and is a high-fidelity indicator of an account compromise.
- ✗
The user authenticated during normal business hours.
Why it's wrong here
Users typically sign in during business hours, and many attackers deliberately time their access to blend in with normal activity. Without an established baseline of the specific account's login patterns, a successful authentication at a normal time is not anomalous and carries very low diagnostic value. This is a normal occurrence, not an indicator of unauthorized access.
- ✓
A new inbox forwarding rule sends mail to an external address.
Why this is correct
An unexpected inbox forwarding rule that redirects mail to an external address is a well-documented persistence and exfiltration technique. Attackers use it to covertly copy sensitive communications and to hide inbound malicious messages from the legitimate user, making it a strong indicator of compromise. Legitimate users rarely create such forwarding rules without an explicit business requirement, so this should be investigated immediately.
- ✗
The user accessed email from a corporate laptop.
Why it's wrong here
A corporate laptop is the expected endpoint for a user's email access, especially if it is managed and compliant with security policies. The device alone does not signal compromise; any user would normally authenticate from such a device. This is ordinary behavior and does not warrant suspicion unless the device itself was previously flagged or compromised.
- ✗
The password age is 89 days.
Why it's wrong here
Password age is a passive attribute that does not, by itself, indicate that an account has been compromised. An 89-day-old password may be well within a typical 90-day rotation policy, and even older passwords are not necessarily weak if they remain secret. This is a common misconception; without evidence of a password leak or brute force, age is irrelevant to the investigation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.