How to Detect Unauthorized Credential Guessing Attempts?

SY0-701 By islever Editorial Last updated

Short answer

D User activity logs

Question

A university employee logged on to the academic server and attempted to guess the system administrators’ log-in credentials. Which of the following security measures should the university have implemented to detect the employee’s attempts to gain access to the administrators’ accounts?
  1. Two-factor authentication
  2. Firewall
  3. Intrusion prevention system
  4. User activity logs Correct Answer

Key Takeaways

This question tests your ability to distinguish between preventive and detective controls, with the common trap being the selection of two-factor authentication, which prevents but does not detect attacks.

Detecting unauthorized credential guessing requires robust logging mechanisms rather than preventive controls. The Security+ community consistently agrees that user activity logs are the correct solution for identifying and reviewing failed login attempts.

Common mistake: Two-factor authentication (A) is frequently chosen incorrectly because candidates confuse prevention with detection; while 2FA blocks unauthorized access, it does not generate records of brute-force or credential-guessing attempts.

Expert Analysis

Why the Answer Is Correct

User activity logs capture authentication events, including multiple failed login attempts from a single source. By implementing centralized logging or monitoring these records, security teams can detect patterns indicative of credential stuffing or brute-force attacks. This aligns perfectly with the question’s explicit requirement to detect the attempts rather than stop them in real-time.

Why the Other Options Are Wrong

Two-factor authentication (A) is a preventive control that adds verification steps but does not log or alert on the initial guessing attempts. Firewalls (B) and Intrusion Prevention Systems (C) operate at the network layer to filter traffic and block known threats, making them ineffective for monitoring internal server authentication attempts. None of these options provide the audit trail necessary for forensic review or behavioral analysis.

Community Comment Notes

Community members heavily emphasize the keyword “DETECT” as the primary differentiator between preventive and detective controls [1]. Multiple comments confirm that user activity logs specifically track failed logins, unusual behavior, and authentication events across systems like Event Viewer and Active Directory [2][3]. The consensus reinforces that logging is the foundational step for any incident response workflow before automated blocking occurs.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always map control types to their function: prevent, detect, deter, or mitigate. When a question emphasizes identifying suspicious behavior after the fact, prioritize logging, SIEM, or auditing solutions over network or authentication barriers.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. fd4ea1a 👍 6 Answered D
    User Activity logs will show when he tried to log in. They arent trying to prevent or it would be 2FA. Key word "DETECT"
  2. Fourgehan 👍 2 Answered D
    User activity logs track user actions, including failed login attempts, unauthorized access attempts, and unusual activity. In this scenario, logging would record the employee's repeated attempts to guess system administrator credentials, which could then be reviewed and flagged as suspicious behavior. By analyzing these logs, security teams can detect and investigate potential unauthorized access attempts.
  3. 9149f41 👍 1 Answered D
    User activities logs are not stored in a single location - they are distributed across different logs and systems for different types of activities and security events. The user activities log can be founds in the following logs: Event Viewer Security logs Application logs System logs Setup logs Active Directory logs Domain controller logs Authentication logs Policy change logs Application-specific logs IIS web server logs SQL Server logs Exchange Server logs Azure/Cloud logs Azure AD sign-in logs Cloud service logs Resource access logs

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide