SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SOC analyst sees many login attempts against one SaaS account from hundreds of IPs over 20 minutes. Most passwords are valid-looking, but only a few result in successful logons, and the successful attempts use a password pattern that was exposed in a public breach list. What is the best mitigation to reduce this attack?
⚠ Common exam trap
The trap here is that candidates often focus on preventing brute-force attempts (e.g., lockouts) rather than recognizing that the attack uses valid breached passwords, making password screening and MFA the correct defense.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement breached-password screening plus MFA.
The attack uses passwords from a public breach list, so breached-password screening would block those known compromised passwords. Additionally, MFA would stop the attacker even if they use a valid breached password, as they lack the second factor. This combination directly addresses the two key weaknesses: reused breached passwords and the lack of additional authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase password length requirements only.
Why it's wrong here
Increasing password length requirements alone fails to mitigate this attack because the attacker is using credentials leaked from prior breaches. A longer password is ineffective if it is already known and present in the attacker's wordlist. While length raises the bar for brute-force attacks, credential stuffing bypasses that barrier by testing valid username/password pairs. The core issue is password reuse, not password complexity, so without screening against breached passwords, the same compromised credentials will still succeed.
- ✓
Implement breached-password screening plus MFA.
Why this is correct
This attack is consistent with credential stuffing, where attackers reuse passwords taken from prior breaches across many accounts. Breached-password screening helps stop users from choosing known-compromised passwords, and MFA adds a second barrier if a password is guessed or reused. Together, these controls reduce the chance that stolen credentials will work at scale. The scenario's pattern of many IPs and a small number of successful logins is exactly the kind of activity these controls are meant to disrupt.
- ✗
Disable account lockouts to avoid user inconvenience.
Why it's wrong here
Disabling account lockouts removes the primary defence against password-spraying attacks, where an attacker tests a small number of valid passwords across many accounts to avoid triggering a lockout threshold. This option is tempting because lockouts can inconvenience legitimate users who mistype passwords, and in a low-volume, targeted brute-force attack against a single account, disabling lockouts might reduce support tickets. However, in this scenario the attacker uses hundreds of distinct IPs and valid-looking passwords from a breach list, so lockouts are the only mechanism that can block the repeated attempts without relying on IP-based rate limiting.
- ✗
Allow unlimited retries so legitimate users are never blocked.
Why it's wrong here
Allowing unlimited retries removes the lockout threshold that would disrupt the automated credential-stuffing tool, which relies on rapid, repeated attempts from many IPs to guess valid passwords. This option is tempting because, in a low-volume environment with legitimate user typos, unlimited retries prevent accidental lockouts; however, it fails here because the attack uses a breached password pattern, so the correct mitigation is to enforce password reset for compromised accounts and enable risk-based conditional access in Microsoft Entra ID to block the session.
Go deeper
Related to this question
Learn chapter
Password Attacks
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.