mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A SOC analyst detects a series of failed login…
A SOC analyst detects a series of failed login attempts from a single external IP address targeting multiple user accounts within a short time. Which action should the analyst take FIRST?
⚠ Common exam trap
ISC2 often tests the principle that containment (e.g., blocking an IP) should not be performed before verifying impact, because the first priority in incident response is to confirm whether a breach actually occurred, not to assume the worst and disrupt operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify if any accounts were successfully compromised.
The correct first step is to verify if any accounts were successfully compromised (Option B). In security operations, the priority is to assess the impact of an incident before taking containment actions. If an account was breached, immediate password resets and session invalidation are needed; blocking the IP prematurely could destroy forensic evidence and alert the attacker, while disabling all accounts causes unnecessary business disruption. The analyst must confirm compromise via log review (e.g., checking for successful authentication events after the failed attempts) to guide the appropriate response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the IP address at the firewall immediately.
Why it's wrong here
Blocking prematurely may disrupt legitimate traffic and should be done after verification.
- ✓
Verify if any accounts were successfully compromised.
Why this is correct
This assesses immediate impact and guides next steps.
- ✗
Disable all user accounts that were targeted.
Why it's wrong here
Disabling accounts without confirmation of compromise would disrupt productivity.
- ✗
Notify law enforcement about the attempted breach.
Why it's wrong here
Law enforcement is contacted after internal investigation and confirmed breach.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Impact
Impact is the measure of the potential damage or harm that a risk event could cause to an organization's assets, operations, or reputation.
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.