Change window: approved 01:00-02:00 01:11:44 jump01 ssh to appsrv02 as configsvc from 10.1.10.20 01:11:47 jump01 ssh to appsrv03 as configsvc from 10.1.10.20 01:12:01 appsrv02 auth.log 2 failed password attempts for configsvc, then success with SSH key 01:12:04 appsrv03 auth.log 1 failed password attempt for configsvc, then success with SSH key 01:12:10 SIEM rule 'brute force against privileged account' triggered CMDB / automation note: configsvc is restricted to Ansible playbooks launched only from jump01 during maintenance windows
Based on the exhibit, what is the most likely conclusion after correlating the logs?
A configuration-management task ran from a jump host and generated repeated login alerts on target servers. The SOC wants to determine whether this is malicious activity or approved automation.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
This is a true brute-force attack because any failed login must be malicious.
A few failed attempts during an approved automation sequence can occur without attacker involvement.
This is a likely false positive caused by approved automation, so the alert should be correlated with the change window.
The alert lines up with an approved maintenance window, a known jump host, and a documented configuration-management account that should only be used by automation. The mixed failed-and-successful logins are consistent with scripts negotiating authentication rather than an intruder guessing passwords. The SOC should confirm the change record, document the benign cause, and adjust correlation rules if this pattern recurs.
This indicates DNS poisoning because both servers were contacted from the same source IP.
DNS poisoning does not explain authentication failures and successful key-based logins on the target systems.
This is proof of ransomware spreading laterally over SMB.
The exhibit shows SSH administrative access, not SMB encryption behavior or file tampering activity.
Common exam trap
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Technical deep dive
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Read the scenario before looking for a memorised answer.
The correct answer is: This is a likely false positive caused by approved automation, so the alert should be correlated with the change window. — This appears to be a false positive once the SOC correlates the alert with approved change activity. The jump host, account restrictions, and maintenance window all match documented automation behavior. A brute-force alert can still fire because of a few failed authentication attempts, but context matters. The correct operational response is to verify the change ticket and tune the detection logic or exception list, not to treat it as an active intrusion. Why others are wrong: Option A is too absolute; security alerts require context, and approved automation can legitimately generate authentication noise. Option C does not fit because the logs describe SSH authentication, not name resolution tampering. Option D is incorrect because nothing in the exhibit shows SMB activity, encryption, or ransom-note behavior associated with ransomware.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.