A SOC analyst notices repeated failed login attempts from a foreign IP address followed by a successful login to a privileged account. What is the most appropriate next step?

The correct answer is A. Reset the affected user's password and investigate the scope of compromise. When suspicious login activity is detected, immediate containment steps such as password resets and log analysis are necessary to limit damage and identify the extent of the compromise.

Cybersecurity Incident Response

Question

Options

AReset the affected user's password and investigate the scope of compromise.
BBlock all foreign IP addresses from accessing the network.
CRun a full vulnerability scan of the corporate network.
DIgnore the event unless it happens again.

How the community answered

(31 responses)

A
55% (17)
B
6% (2)
C
13% (4)
D
26% (8)

Explanation

When suspicious login activity is detected, immediate containment steps such as password resets and log analysis are necessary to limit damage and identify the extent of the compromise.

Topics

#brute force attack#privileged account compromise#SOC analysis#incident triage

Community Discussion

Mateus R.May 6, 2026

Think of it like coming home and finding your front door unlocked after a stranger was seen jiggling the handle outside. You do not call the city to ban all foreign cars from your street, and you do not shrug and wait to see if they come back tomorrow. You change the lock immediately and then walk through every room to see what, if anything, was touched. That is exactly what answer A is telling you to do: kill the attacker's access by resetting the password, then scope the damage by investigating what that privileged account touched after the successful login. B is a blunt, operationally destructive overreaction that does nothing about the account that is already compromised. C is a distraction, because a vulnerability scan tells you about weaknesses, not about what an active intruder already did with the access they gained. And D gets you fired. The correct answer is A.

Samuel O.Mar 7, 2026

A is the right call here. You have a clear indicator of compromise, a privileged account that someone just walked into after hammering it with failed attempts, so the clock is already ticking. You reset the password to cut off whatever access was just gained, then you start pulling logs to figure out what they touched, what they exfiltrated, and whether they used that account to pivot laterally. Blocking all foreign IPs (B) is a blunt instrument that breaks legitimate business, and running a vuln scan (C) does nothing to contain an active intrusion. D is how you explain to a federal auditor why you ignored a textbook brute-force-to-success event.

Fatima Z.Mar 2, 2026

Spot on, A is your move here, and the mnemonic to lock it in is RSI, Reset, Scope, Investigate, which is exactly the order you work through any account takeover scenario on the exam. Blocking all foreign IPs (B) is way too broad and would tank legitimate business traffic, a full vuln scan (C) is a different workflow entirely, and D is basically handing the attacker a second invitation.

Carlos M.Feb 20, 2026

Honestly I keep going back to D on this one. The question says "repeated failed attempts followed by a successful login" but it does not say the successful login did anything harmful, and in a lot of orgs privileged users travel or use VPNs that exit from foreign IPs all the time. You do not want SOC analysts pulling fire alarms every time a login pattern looks unusual without confirmed malicious activity, because alert fatigue is a real problem and you end up chasing ghosts. The scenario also says "notices" not "confirms a breach," so there is no evidence yet that an incident occurred. If this exact behavior happens again then you have a pattern worth escalating, but a single event with no observed data exfiltration or lateral movement does not meet the threshold for incident response in most frameworks I have read.

Fatima Z.Feb 21, 2026

Carlos, the mnemonic here is FAIL-THEN-NAIL, because repeated failures followed by a success from an anomalous IP is itself the indicator of compromise in every major framework, and that pattern alone clears the threshold for treating it as a potential incident under A, no exfiltration required. Alert fatigue is real, but the whole point of incident response is to investigate first so you can rule harm out, not to wait until harm is confirmed before you pick up the phone.

Full 100-160 Practice