100-160 Question 229
Single answerYou are monitoring security events in your organization's SIEM (Security Information and Event Management) system and notice several failed login attempts from the same IP address targeting a high-privilege account within a short period. What is the appropriate action to take in this situation?
- A
Ignore the event, as failed logins are common and not necessarily an indicator of a threat.
- B
Block the IP address immediately without further investigation.
- C
Escalate the event to the incident response team as a potential brute-force attack.
- D
Disable the high-privilege account temporarily to prevent unauthorized access.
Show answer and explanation
Correct answer: C
Explanation
When monitoring security events, recognizing patterns of suspicious activity, such as multiple failed login attempts from the same IP address targeting a high-privilege account, is crucial. This behavior strongly suggests a potential brute-force attack. The best course of action is to escalate the event to the incident response team for proper investigation and mitigation, as they can determine the appropriate next steps to protect the system while minimizing disruption.
- A. Incorrect.
Ignoring the event is inappropriate, as multiple failed login attempts targeting a high-privilege account could indicate a brute-force attack or other malicious activity.
- B. Incorrect.
Blocking the IP address immediately without investigation could disrupt legitimate business operations if the IP is not malicious. Proper investigation and escalation are necessary first.
- C. Correct.
Escalating the event to the incident response team is the correct action, as it ensures that the potential threat is analyzed and mitigated by the appropriate experts.
- D. Incorrect.
Disabling the high-privilege account temporarily may not be the best first step without incident response team input, as it could disrupt critical operations unnecessarily.