Discuss Cisco 100-160 Exam Topic 3 Question 17

A SOC analyst notices repeated failed login attempts from a foreign IP address followed by a successful login to a privileged account. What is the most appropriate next step?

AReset the affected user's password and investigate the scope of compromise.

BBlock all foreign IP addresses from accessing the network.

CRun a full vulnerability scan of the corporate network.

DIgnore the event unless it happens again.

Suggested Answer: A

The CCST Cybersecurity course highlights that signs of brute-force attacks followed by successful access require immediate account security actions and an investigation to determine if other systems were accessed.

'When suspicious login activity is detected, immediate containment steps such as password resets and log analysis are necessary to limit damage and identify the extent of the compromise.'

(CCST Cybersecurity, Incident Handling, Account Compromise Response section, Cisco Networking Academy)

Get Premium 100-160 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Annabelle 2 months ago

B seems too extreme. Not all foreign IPs are bad. A is safer.

Gennie 2 months ago

Agreed, A makes sense. We need to investigate the breach.

Wilson 2 months ago

I think A is the best choice. Resetting the password is crucial.

Quentin 2 months ago

Not sure about A, what if it was just a false alarm?

Pamela 3 months ago

Wait, they actually logged in after failed attempts? That's wild!

Staci 3 months ago

I agree with A, we need to investigate further.

Serina 3 months ago

Blocking all foreign IPs seems extreme, B isn't the best choice.

Thersa 3 months ago

Definitely A, reset that password ASAP!

Catherin 3 months ago

Ignoring the event seems risky, but I guess some might think it’s not a big deal unless it happens again.

Ressie 3 months ago

This question feels familiar; I think we practiced a similar scenario where investigating the scope of compromise was crucial.

Lili 4 months ago

I'm not entirely sure, but blocking all foreign IPs seems too extreme. What if they’re legitimate users?

Billy 4 months ago

I remember we discussed the importance of immediate action in cases of unauthorized access, so I think resetting the password makes sense.

Cisco 100-160 Exam - Topic 3 Question 17 Discussion