CCOA Securing Assets Practice Question
While monitoring security logs in Splunk for your critical database server, you observe a spike in '401 Unauthorized' errors followed by a '200 OK' success from a known administrative account. How should you investigate this to confirm a potential credential stuffing attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the 'web_access.log' for the source IP of the successful login and compare the User-Agent string to previous successful logins.
To distinguish between a user mistyping a password and an automated attack, you must correlate the timing, source IP distribution, and the subsequent behavior of the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the administrative account immediately without further analysis.
Why it's wrong here
Disabling the account interrupts business operations without confirming if the activity was a false positive or a true security incident.
- ✓
Check the 'web_access.log' for the source IP of the successful login and compare the User-Agent string to previous successful logins.
Why this is correct
Comparing User-Agent and source IP patterns against historical baselines is the standard method for identifying credential stuffing anomalies.
- ✗
Restart the database service to clear the connection pool.
Why it's wrong here
Restarting services does not help in identifying the source or nature of the attack.
- ✗
Increase the logging level on the database to 'Debug' to capture the password hash being transmitted.
Why it's wrong here
Increasing log levels to debug is rarely necessary and introduces risks of logging sensitive data.
About these practice questions
One of 203 original CCOA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official ISACA exam blueprint
This CCOA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCOA exam.