SY0-701 Security Operations Practice Question
A SOC analyst sees 38 failed logins for a finance user account from one public IP address over 4 minutes, followed by one successful login. What should the analyst do first?
⚠ Common exam trap
It's easy for candidates to assume a successful login after many failures always indicates compromise, but the question tests the critical first step of verification through log correlation before taking any action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.
The analyst must first verify whether the failed logins followed by a successful login represent a brute-force attack or legitimate behavior, such as a user mistyping their password and then succeeding. Correlating authentication logs with user activity and VPN records helps confirm if the public IP belongs to a known remote user or VPN endpoint, which is a standard first step in incident response to avoid false positives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately delete the account to stop any further access attempts.
Why it's wrong here
Deleting a user account is an irreversible administrative action that destroys the user's mapped access rights, group memberships, and associated ACLs; it also severs any attribution chain needed for forensic investigation. At triage stage, the analyst lacks evidence that the account is truly compromised rather than a misconfigured MFA or a scripted logon. Deleting also interrupts legitimate business operations and can trigger data recovery and identity restoration efforts. The correct immediate step is to gather more context, not to destroy the identity asset.
- ✓
Correlate the authentication logs with user activity and VPN records to verify whether the login pattern is expected.
Why this is correct
Correlating related logs is the best first step because it helps determine whether the event is a real attack or an expected user behavior pattern. Authentication logs, VPN records, and account activity can show whether the source IP, timing, and device match a legitimate session. Good triage focuses on confirmation before disruptive response actions.
- ✗
Assume the account is compromised and notify all users to change their passwords.
Why it's wrong here
Assuming compromise and forcing a company-wide password reset is a classic over-reaction to a single account's anomaly. The event is localized to one finance user, so a mass reset creates broad operational friction and password fatigue without addressing the actual source IP or authentication behavior. Worse, it may tip off an actual attacker and cause them to change tactics before the analyst has correlated logs. Triage requires evidence-based scoping: first confirm whether the failed attempts came from a known baseline, an internal service account, or a legitimate remote user with a stale VPN session.
- ✗
Close the alert because one successful login means the activity was normal.
Why it's wrong here
A single successful login does not validate the preceding 38 failures as normal; in a brute-force or credential-stuffing attack, the one success is precisely the final event. Attackers often use distributed source IPs and timing offsets to evade simple lockout policies, so the analyst must inspect sign-in timestamps, federated identity provider events, and the user's historical geographic pattern. Closing the alert based on a single success ignores the possibility of account takeover that will be followed by data exfiltration. The alert requires correlation with anti-malware, EDR, or cloud identity analytics to determine if post-authentication behavior is anomalous.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.