SY0-701 Security Operations Practice Question
After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?
⚠ Common exam trap
It's easy for candidates to assume MFA is infallible and ignore the geographic anomaly, leading them to delete the alert (Option C) or take premature action (Option A or D) without performing proper log correlation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.
The alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the account immediately without checking any other logs.
Why it's wrong here
Disabling the account immediately is a premature containment action that lacks investigative context. Without correlating identity provider, VPN, or endpoint logs, you cannot determine whether the login originated from a legitimate travel destination, a corporate VPN, or a malicious proxy. This action risks locking out the genuine user, causing business disruption, and could even tip off an attacker before you gather evidence to scope the incident correctly.
- ✓
Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.
Why this is correct
This is the best first step because triage should validate the alert and establish context before disruptive containment. Correlating identity provider, VPN, and endpoint telemetry can show whether the login came from an expected corporate path, a known remote-access method, or a likely compromise. The analyst can then decide whether account disablement, password resets, or escalation is warranted based on evidence rather than a single suspicious event.
- ✗
Delete the alert because MFA was enabled and the login eventually succeeded.
Why it's wrong here
Deleting the alert solely because MFA was enabled and the login eventually succeeded is a dangerous false sense of security. Successful MFA does not rule out account takeover techniques like MFA fatigue, adversary-in-the-middle relay attacks, or session cookie theft where the attacker authenticates after the user. Additionally, deleting the alert removes a critical audit trail that might reveal a larger pattern of unauthorized access, making it impossible to detect or investigate a potential compromise.
- ✗
Reimage the user's laptop to remove any possible malware right away.
Why it's wrong here
Reimaging the user's laptop is an overly aggressive and irreversible response that assumes endpoint malware is the root cause without any evidence. Since the alert is MFA-related, the compromise could be identity-based (e.g., stolen credentials or token replay) rather than a local infection, and reimaging would not address that. It also destroys volatile evidence from the system, hampering the security investigation and potentially violating chain-of-custody requirements if the incident escalates to formal response.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.