CISSP Practice Question: A security analyst notices repeated failed login…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Analyze the log events to identify the attack pattern and implement additional controls such as MFA

  Why this is correct

  Analyzing log events is the foundational step in incident response, providing crucial intelligence about the attacker's methods, source IPs, and targeted accounts. This forensic analysis enables security teams to identify specific attack patterns, such as brute-force or credential stuffing, and determine the scope and nature of the threat. Implementing additional controls like Multi-Factor Authentication (MFA) directly addresses the risk of compromised credentials by requiring a second verification factor, significantly enhancing account security even if a password is breached. This targeted approach ensures effective mitigation while minimizing disruption.

• ✗

  Increase the account lockout threshold

  Why it's wrong here

  Increasing the account lockout threshold is counterproductive in response to repeated failed login attempts, as it effectively grants attackers more attempts before an account is locked. This action would prolong a brute-force or credential stuffing attack, providing the adversary with an extended window to guess valid credentials. Instead of mitigating the threat, a higher threshold inadvertently aids the attacker by making it easier to bypass existing security controls designed to prevent such attacks. The goal should be to stop the attack, not to give it more leeway.

• ✗

  Ignore the event as it is likely a false positive

  Why it's wrong here

  Ignoring repeated failed login attempts, especially when originating from multiple IP addresses, is a severe security oversight and a dangerous assumption. Such activity is a strong indicator of malicious intent, likely a brute-force attack, credential stuffing, or a distributed denial-of-service attempt targeting authentication services. Dismissing these critical alerts as false positives leaves systems vulnerable to compromise, potentially leading to unauthorized access, data breaches, or service disruption. Proper incident response mandates immediate investigation, not dismissal.

• ✗

  Disable the user account being targeted

  Why it's wrong here

  Disabling the targeted user account without further analysis is a premature and potentially disruptive action that fails to address the underlying attack. If the account belongs to a legitimate user, disabling it would cause a denial of service for that individual, impacting business operations unnecessarily. Furthermore, this action does not stop the attacker from continuing their attempts against other accounts or exploiting other vulnerabilities, merely shifting their focus. A comprehensive analysis is required to determine if the account is compromised or if the attack is simply targeting a valid, active user.

Go deeper

Related to this question