SY0-501 · Question #49
A security administrator returning from a short vacation receives an account lock-out message when attempting to log into the computer. After getting the account unlocked the security administrator…
The correct answer is B. Continuous monitoring. The security administrator discovered a brute force attack after multiple account lockouts. Implementing continuous monitoring would have detected the attack earlier, reducing its undetected duration.
Question
A security administrator returning from a short vacation receives an account lock-out message when attempting to log into the computer. After getting the account unlocked the security administrator immediately notices a large amount of emails alerts pertaining to several different user accounts being locked out during the past three days. The security administrator uses system logs to determine that the lock-outs were due to a brute force attack on all accounts that has been previously logged into that machine. Which of the following can be implemented to reduce the likelihood of this attack going undetected?
Options
- APassword complexity rules
- BContinuous monitoring
- CUser access reviews
- DAccount lockout policies
How the community answered
(51 responses)- A8% (4)
- B76% (39)
- C2% (1)
- D14% (7)
Why each option
The security administrator discovered a brute force attack after multiple account lockouts. Implementing continuous monitoring would have detected the attack earlier, reducing its undetected duration.
Password complexity rules strengthen user passwords, making them harder to guess, but they do not provide mechanisms for detecting ongoing brute force attempts or alerting administrators to such attacks.
Continuous monitoring involves the real-time or near real-time collection and analysis of security logs and events from systems, allowing for immediate detection of anomalous login patterns characteristic of a brute force attack. By actively tracking login failures and other security alerts, security teams can receive timely notifications and respond quickly, thus reducing the likelihood of the attack going undetected for an extended period.
User access reviews periodically verify and adjust user permissions to ensure appropriate access, which is a control unrelated to the detection of login-based brute force attacks.
Account lockout policies automatically lock accounts after a specified number of failed login attempts, serving as a reactive mitigation measure against brute force attacks rather than a proactive detection method to alert administrators.
Concept tested: Security event detection and continuous monitoring for attacks
Source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/security-monitoring
Topics
Community Discussion
No community discussion yet for this question.