SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It is definitely a brute-force attack and should be treated as confirmed compromise.

  Why it's wrong here

  A brute-force attack typically produces a high-volume, automated pattern of failed authentication attempts originating from one or more remote sources in rapid succession, often targeting multiple accounts. Here, the analyst has only 20 failed logins for a single user account, with no indication of source diversity, login time clustering, or a successful authentication following the failures. Without corroborating evidence such as impossible travel, unusual geolocation, or pass-the-hash activity, treating this as a confirmed compromise is premature and risks unnecessary containment actions.

• ✓

  It is most likely a false positive caused by user error and should be documented after verification.

  Why this is correct

  The most plausible explanation is that the user mistyped their password repeatedly due to human error, such as Caps Lock being active, an expired password, or a typo, and the login attempts originated from a location consistent with the user's typical behavior. The analyst should verify the user's account, correlate the timestamps with the user's reported activity, and document the incident as a false positive for compliance and future correlation. This approach aligns with the incident response principle of validating alerts with context before escalating, avoiding alert fatigue and unnecessary operational disruption.

• ✗

  It is evidence of malware on the user's workstation until the device is rebuilt.

  Why it's wrong here

  Malware on a workstation would not manifest merely as repeated failed logins for a single user; it would more likely cause credential theft, lateral movement, or outbound beaconing, and endpoint indicators such as unusual processes, scheduled tasks, or registry modifications would be present. The failed logins likely reflect a user-level authentication issue rather than a system-level compromise. Rebuilding the device is a drastic, resource-intensive response that should be reserved for instances where forensics or behavioral indicators confirm malware, not for a benign pattern of user error.

• ✗

  It proves the password was changed by an attacker and the account must be disabled immediately.

  Why it's wrong here

  A password change by an attacker would generate specific event logs, such as a successful password reset attempt by another account or a separate password change audit event, and would likely be accompanied by logons from unfamiliar IP addresses or unusual times after the change. In this case, there is no evidence that the password was altered, no successful unauthorized access, and no indicators of account takeover, so disabling the account immediately is an overreaction. The correct action is to investigate and verify the cause of the failures, not to assume the worst-case scenario based on a single symptom.

Go deeper

Related to this question