While investigating a possible incident, a security analyst discovers the following log entries: Which of the following should the analyst do first?

The correct answer is D. Check the users table for new accounts. The logs show an SQL injection attack. The first step is to verify if new accounts have been created, indicating a successful injection.

Submitted by miguelv· Mar 6, 2026Security Operations

Question

While investigating a possible incident, a security analyst discovers the following log entries:

Which of the following should the analyst do first?

Exhibit

Options

AImplement a WAF
BDisable the query .php script
CBlock brute-force attempts on temporary users
DCheck the users table for new accounts

How the community answered

(65 responses)

A
9% (6)
B
6% (4)
C
26% (17)
D
58% (38)

Explanation

The logs show an SQL injection attack. The first step is to verify if new accounts have been created, indicating a successful injection.

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice