A help desk technician reports that a user's account was locked out three times overnight. The security team reviews the authentication logs and discovers that the lockouts resulted from failed login attempts originating from a single external IP address, each attempt using a slightly different variation of the user's password. Which of the following should the security analyst do FIRST?

Block the external IP address at the perimeter firewall.

Blocking the IP may be part of containment, but it should not be the first step without verifying the attack is real and understanding the scope. The IP could be a legitimate proxy or VPN, and blocking it prematurely might disrupt services or hide further malicious activity.

Disable the user account and require a password reset.

Disabling the account prevents the user from accessing resources and might be necessary if compromise is confirmed, but doing so without investigation could be premature. The user may need access, and the lockouts could be a failed brute-force with no successful login.

Increase the account lockout threshold to prevent future lockouts.

Raising the lockout threshold weakens the security posture and makes the account more vulnerable to brute-force attacks. This is not a proper response to an active attack; it does not address the current incident and may encourage attackers.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Investigate the user's recent activity for signs of compromise. — The pattern of multiple failed login attempts with password variations from a single external IP indicates a brute-force or credential-stuffing attack. Before taking any other action, the analyst must investigate the user's recent activity to determine if the account was successfully breached or if there are other signs of compromise (e.g., unusual logins, data access). Blocking the IP address (A) may be necessary but should be done after confirming the attack is ongoing and not a false positive. Disabling the account and resetting the password (B) is a reactive step that could disrupt the user without a full understanding of the incident. Increasing the lockout threshold (D) reduces security and is not recommended as a first response. Therefore, investigation is the appropriate first step in the incident response process.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.