312-39 · Question #8
At a large healthcare organization, the Security Operations Center (SOC) detects a surge of failed login attempts on employee accounts, indicating a possible brute-force attack. To contain the…
The correct answer is D. Enable multi-factor authentication (MFA). MFA is the most effective long-term control among the options because it directly reduces the attacker’s ability to succeed even when passwords are guessed, reused, or stolen. Brute-force and credential stuffing attacks exploit the single-factor nature of passwords; MFA adds an…
Question
At a large healthcare organization, the Security Operations Center (SOC) detects a surge of failed login attempts on employee accounts, indicating a possible brute-force attack. To contain the threat, the team quickly takes action to prevent unauthorized access. However, they also need to implement a security measure that strengthens account protection beyond just stopping the current attack, reducing the risk of similar incidents in the future. During the Containment Phase, which action would best enhance long-term account security against brute-force attacks?
Options
- ANotify affected users
- BBlock IP addresses and enforce account lockout policies
- CCross-verify false positives
- DEnable multi-factor authentication (MFA)
How the community answered
(20 responses)- A10% (2)
- C5% (1)
- D85% (17)
Explanation
MFA is the most effective long-term control among the options because it directly reduces the attacker’s ability to succeed even when passwords are guessed, reused, or stolen. Brute-force and credential stuffing attacks exploit the single-factor nature of passwords; MFA adds an additional verification factor (authenticator app prompt, FIDO2 key, certificate-based auth), making account takeover significantly harder. From a containment standpoint, blocking IPs and enabling lockout can reduce immediate attack volume, but attackers commonly rotate IPs, use botnets, or target many accounts in parallel, which can also cause operational impact via account lockouts (denial of service against users). Cross-verifying false positives is important for accuracy, but it does not strengthen best practice is layered containment: immediate throttling/blocks and lockout tuning for the active attack, followed by durable hardening controls. MFA is the durable hardening step that meaningfully reduces future brute-force success rates and complements conditional access policies (geo/time/device risk) and stronger password protections.
Topics
Community Discussion
No community discussion yet for this question.