Security Analyst Login Alert Triage Quiz

1. Which of the following is a sign of credential compromise requiring immediate action?

User logs in from their home office instead of headquarters

Multiple accounts logging in from the same unusual IP simultaneously

A user accessing their email 5 minutes later than usual

Login occurring on a weekend

2. True or False: Disabling MFA simplifies the login process and reduces false-positive alerts.

True

False

3. True or False: A login from a residential proxy IP address always indicates a legitimate user working remotely.

True

False

Submit

7. Which security control directly prevents unauthorized logins from using compromised credentials?

Network segmentation

Multi-factor authentication

Encryption at rest

Data loss prevention (DLP)

8. A user's account shows a login from a new device with a different operating system. What additional verification should be performed?

Immediately revoke all tokens

Contact the user to verify device ownership and legitimacy

Block the device permanently

Do nothing; new devices are always legitimate

9. What is the primary benefit of correlating login alerts with other security events (file access, privilege changes)?

Reducing false positives and identifying attack chains

Increasing network latency

Simplifying password policies

Eliminating the need for MFA

10. How do threat actors typically use stolen credentials in initial access?

They immediately sell them on the dark web

They use them for reconnaissance before lateral movement

They display them in system alerts

They ignore them and use malware instead

11. When triaging a suspicious login alert, which indicator suggests the highest risk?

Login from a known office IP during business hours

Login from a new geographic location at an unusual time

Login using a password that hasn't been changed in 6 months

Login attempt with a slight delay in credential entry

12. When should a suspicious login alert be escalated to the incident response team?

Only if the user confirms it was unauthorized

When multiple risk indicators are present or credentials are compromised

Only during business hours

After 24 hours of monitoring

13. What information does a User and Entity Behavior Analytics (UEBA) tool provide for login triage?

Only password strength metrics

Baseline user behavior and anomaly detection

Real-time network packet capture

Historical password change logs only

14. A login alert shows authentication from an IP belonging to a known VPN provider. How should this be classified?

High risk; immediately block the IP

Critical threat; lock the account

Low risk; requires context but not necessarily malicious

Medium risk; always escalate to management

15. Which step should be taken first when responding to a confirmed unauthorized login?

Delete the user's account immediately

Force a password reset and enable MFA

Terminate all active sessions and isolate the account

Send a warning email to the user

16. What does a spike in failed login attempts typically indicate?

User forgot their password

Potential brute force or credential attack

Network connectivity issues

System maintenance in progress

17. When investigating a suspicious login, which log source provides the most detailed authentication event information?

Firewall logs

SIEM authentication logs

Router traffic logs

Application server error logs

18. A user's account logs in from Brazil at 2 AM local time, then from Japan at 3 AM local time 30 minutes later. What is this behavior pattern called?

Brute force attack

Dictionary attack

Impossible travel

Privilege escalation

19. Which authentication factor would best prevent credential stuffing attacks during login?

Longer password requirements

Multi-factor authentication (MFA)

Password complexity rules only

Regular security awareness training

20. What is the primary purpose of analyzing login velocity in security analytics?

To measure network bandwidth consumption

To detect multiple logins from distant locations in a short timeframe

To track user productivity metrics

To monitor database query performance

Security Analyst Triaging a Suspicious Login Alert Quiz