100-160 Question 226
Single answerYou are monitoring security events through a Security Information and Event Management (SIEM) system and notice a significant increase in failed login attempts from a single IP address targeting multiple user accounts. What is the most appropriate initial action to take in this scenario?
- A
Escalate the incident to the security operations team immediately for further investigation.
- B
Block the suspicious IP address at the firewall without further analysis.
- C
Ignore the activity and continue monitoring for other events.
- D
Notify the affected users to change their passwords immediately.
Show answer and explanation
Correct answer: A
Explanation
In this scenario, the significant increase in failed login attempts from a single IP address is a potential indicator of a brute-force attack. The appropriate initial action is to escalate the event to the security operations team for further investigation. This ensures a thorough analysis of the threat, preservation of evidence, and proper escalation according to the organization's incident response plan. Prematurely blocking the IP or ignoring the event can lead to mishandling, while notifying users without addressing the root cause does not resolve the immediate risk.
- A. Correct.
Escalating the incident to the security operations team is the correct action because it allows for proper investigation and response, ensuring that no critical evidence is missed and the situation is handled according to organizational protocols.
- B. Incorrect.
Blocking the IP address without further analysis may disrupt legitimate activity if the IP address is not actually malicious or if it is spoofed. This action should be taken only after proper investigation.
- C. Incorrect.
Ignoring the activity is inappropriate, as a significant increase in failed login attempts is a clear indicator of a potential brute-force attack and requires action.
- D. Incorrect.
While notifying affected users is important, it is not the immediate action to take in this scenario. The priority is to investigate and mitigate the potential threat first.