SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Repeated failed logins followed by a successful login from the same source IP.

  Why this is correct

  Multiple failed attempts from the same source IP indicate a systematic credential attack rather than an accidental lockout. When a successful authentication follows immediately after, it strongly suggests the attacker eventually guessed or sprayed a valid password. This is a classic signature of brute-force or password-spraying and is a high-fidelity indicator of an account compromise.

• ✗

  The user authenticated during normal business hours.

  Why it's wrong here

  Users typically sign in during business hours, and many attackers deliberately time their access to blend in with normal activity. Without an established baseline of the specific account's login patterns, a successful authentication at a normal time is not anomalous and carries very low diagnostic value. This is a normal occurrence, not an indicator of unauthorized access.

• ✓

  A new inbox forwarding rule sends mail to an external address.

  Why this is correct

  An unexpected inbox forwarding rule that redirects mail to an external address is a well-documented persistence and exfiltration technique. Attackers use it to covertly copy sensitive communications and to hide inbound malicious messages from the legitimate user, making it a strong indicator of compromise. Legitimate users rarely create such forwarding rules without an explicit business requirement, so this should be investigated immediately.

• ✗

  The user accessed email from a corporate laptop.

  Why it's wrong here

  A corporate laptop is the expected endpoint for a user's email access, especially if it is managed and compliant with security policies. The device alone does not signal compromise; any user would normally authenticate from such a device. This is ordinary behavior and does not warrant suspicion unless the device itself was previously flagged or compromised.

• ✗

  The password age is 89 days.

  Why it's wrong here

  Password age is a passive attribute that does not, by itself, indicate that an account has been compromised. An 89-day-old password may be well within a typical 90-day rotation policy, and even older passwords are not necessarily weak if they remain secret. This is a common misconception; without evidence of a password leak or brute force, age is irrelevant to the investigation.