100-160 Question 228
Single answerYou are monitoring security events on your organization's network and notice a large number of failed login attempts to a critical server within a short period of time. What should you do next?
- A
Ignore the events since they could be caused by a user forgetting their password.
- B
Immediately escalate the issue to the incident response team.
- C
Investigate further by checking the source IP addresses and associated user accounts.
- D
Disable all user accounts on the server to prevent further login attempts.
Show answer and explanation
Correct answer: C
Explanation
When monitoring security events, it is crucial to first investigate further to confirm whether the activity is malicious or benign. In this scenario, analyzing the source IP addresses and user accounts involved in the failed login attempts provides valuable context to help decide if escalation to the incident response team is required. Escalation should only occur after verifying the threat to avoid unnecessary disruptions.
- A. Incorrect.
Ignoring the events could lead to a potential security incident going unnoticed. Failed login attempts, especially in large numbers, may indicate a brute-force attack or other malicious activity.
- B. Incorrect.
While escalation might be necessary later, immediately escalating without further investigation could waste resources if the event turns out to be benign.
- C. Correct.
Investigating the source IP addresses and user accounts is the correct action, as it allows you to gather more context about the incident. This helps determine whether escalation is needed or if the issue can be resolved locally.
- D. Incorrect.
Disabling all user accounts is an extreme and unnecessary action at this stage. It would disrupt normal operations and is not an appropriate initial response.