Free Preparation Discussions
MENU
CompTIA CAS-005 Exam - Topic 4 Question 16 Discussion
Topic #: 4
[Security Operations]
A company'sSIEMis designed to associate the company'sasset inventorywith user events. Given the following report:
Which of thefollowing should asecurity engineer investigate firstas part of alog audit?
Comprehensive and Detailed
Understanding the Security Event:
Administrator accounts are highly privilegedand require strict monitoring.
Server 4 shows failed login attempts for the administrator account.This could indicate abrute-force attack or unauthorized access attempt.
The fact thatnone of the admin login attempts were successfulsuggestssomeone was trying to guess the credentials.
Why Option D isCorrect:
Failed logins for administrator accounts are a critical security concern.
If an attacker gains access, they couldescalate privileges and compromise the network.
Investigatingunauthorized admin login attemptsshould be thetop priorityin a log audit.
Why Other Options Are Incorrect:
A (Endpoint not submitting logs):While this is concerning, it does not indicate anactive attack.
B (Lateral movement):There's no evidence of a compromised account moving between servers yet.
C (Misconfigured syslog server):False negatives are a possibility, but thefailed admin loginsare real.
CompTIA SecurityX CAS-005 Official Study Guide:SIEM & Incident Analysis
MITRE ATT&CK (T1078.002):Valid Accounts - Administrator Compromise
Miles
2 months agoRessie
2 months agoLucy
3 months agoOzell
3 months agoKate
3 months agoDelpha
3 months agoCassi
4 months agoKara
4 months agoYvonne
4 months agoCatarina
4 months agoWilletta
4 months agoLashonda
4 months agoGail
5 months agoCathrine
7 months agoJamey
7 months agoBernardo
7 months agoIvan
7 months agoWilda
5 months agoMarta
5 months agoLoise
5 months agoDeonna
7 months agoIlene
7 months agoNatalie
8 months agoNorah
7 months agoRyan
7 months agoStephanie
7 months agoBernardo
8 months agoCristen
8 months agoArleen
7 months agoWalker
7 months agoIola
8 months ago