SY0-701 Question 139
Single answerMonitoringA security analyst is reviewing alerts from the company's monitoring platform after several users reported intermittent access issues to an internal finance application. The platform shows repeated failed logon attempts against multiple servers, followed by a successful logon to one server using a service account outside its normal schedule. The analyst wants to improve monitoring so similar activity is detected earlier and with fewer false positives. Which of the following monitoring improvements would BEST address this requirement?
- A
Configure the monitoring system to generate an alert for every failed logon event on any server
- B
Create a baseline for normal service account logon times and trigger an alert when a successful logon deviates from that pattern after multiple failed attempts
- C
Disable logging for failed logon attempts from internal IP addresses to reduce alert volume
- D
Increase the retention period for all logs from 30 days to 1 year
Show answer and explanation
Correct answer: B
Explanation
The strongest monitoring improvement is to baseline normal behavior and use correlated alerting for suspicious deviations. In this scenario, the meaningful indicators are not just failed logons, but the sequence of multiple failed attempts followed by an unusual successful service account logon outside its expected pattern. This aligns with security monitoring best practices from common industry guidance such as NIST SP 800-61 for incident handling and NIST SP 800-137 for information security continuous monitoring, both of which emphasize collecting relevant events, analyzing them in context, and tuning monitoring to support timely detection. Retention is valuable for forensic review, and raw failed-logon alerts may still be collected, but the most effective operational improvement is behavior-based monitoring with correlation to reduce noise and highlight probable malicious activity.
- A. Incorrect.
This is not the best improvement because alerting on every failed logon event would likely generate excessive noise and false positives. Failed logons happen routinely because of user mistakes, expired passwords, and misconfigured services. Effective monitoring in Security+ contexts emphasizes actionable alerts and tuning rather than indiscriminate alerting.
- B. Correct.
This is the best answer because it combines baselining with correlation. Establishing normal behavior for a service account and alerting on deviations, especially when paired with preceding failed logon attempts, improves early detection while reducing false positives. This reflects common SIEM and UEBA-style monitoring practices, where context and anomalies are more useful than isolated events.
- C. Incorrect.
This is incorrect because failed logons from internal IP addresses can still indicate credential attacks, lateral movement, or misuse of compromised systems. Suppressing these events would create a monitoring blind spot. Internal traffic should not be assumed trustworthy, especially in modern security monitoring practices.
- D. Incorrect.
This is not the best answer because longer log retention helps with investigations, compliance, and historical analysis, but it does not by itself improve early detection or reduce false positives. The requirement is to detect similar activity sooner and more accurately, which is better addressed through baselining and correlation rules.