How to Detect Unauthorized Credential Guessing Attempts?

A university employee logged on to the academic server and attempted to guess the system administrators’ log-in credentials. Which of the following security measures should the university have implemented to detect the employee’s attempts to gain access to the administrators’ accounts?

  1. Two-factor authentication
  2. Firewall
  3. Intrusion prevention system
  4. User activity logs Source Reference Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your ability to distinguish between preventive and detective controls, with the common trap being the selection of two-factor authentication, which prevents but does not detect attacks.

Detecting unauthorized credential guessing requires robust logging mechanisms rather than preventive controls. The Security+ community consistently agrees that user activity logs are the correct solution for identifying and reviewing failed login attempts.

Two-factor authentication (A) is frequently chosen incorrectly because candidates confuse prevention with detection; while 2FA blocks unauthorized access, it does not generate records of brute-force or credential-guessing attempts.

Community Discussion (3 comments)

fd4ea1a 👍 6 Selected: D
User Activity logs will show when he tried to log in. They arent trying to prevent or it would be 2FA. Key word "DETECT"
9149f41 👍 1 Selected: D
User activities logs are not stored in a single location - they are distributed across different logs and systems for different types of activities and security events. The user activities log can be founds in the following logs: Event Viewer Security logs Application logs System logs Setup logs Active Directory logs Domain controller logs Authentication logs Policy change logs Application-specific logs IIS web server logs SQL Server logs Exchange Server logs Azure/Cloud logs Azure AD sign-in logs Cloud service logs Resource access logs
Fourgehan 👍 2 Selected: D
User activity logs track user actions, including failed login attempts, unauthorized access attempts, and unusual activity. In this scenario, logging would record the employee's repeated attempts to guess system administrator credentials, which could then be reviewed and flagged as suspicious behavior. By analyzing these logs, security teams can detect and investigate potential unauthorized access attempts.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

User activity logs capture authentication events, including multiple failed login attempts from a single source. By implementing centralized logging or monitoring these records, security teams can detect patterns indicative of credential stuffing or brute-force attacks. This aligns perfectly with the question’s explicit requirement to detect the attempts rather than stop them in real-time.

Why the Other Options Are Wrong

Two-factor authentication (A) is a preventive control that adds verification steps but does not log or alert on the initial guessing attempts. Firewalls (B) and Intrusion Prevention Systems (C) operate at the network layer to filter traffic and block known threats, making them ineffective for monitoring internal server authentication attempts. None of these options provide the audit trail necessary for forensic review or behavioral analysis.

Community Comment Notes

Community members heavily emphasize the keyword “DETECT” as the primary differentiator between preventive and detective controls [1]. Multiple comments confirm that user activity logs specifically track failed logins, unusual behavior, and authentication events across systems like Event Viewer and Active Directory [2][3]. The consensus reinforces that logging is the foundational step for any incident response workflow before automated blocking occurs.

Official Reference

Exam Strategy

Always map control types to their function: prevent, detect, deter, or mitigate. When a question emphasizes identifying suspicious behavior after the fact, prioritize logging, SIEM, or auditing solutions over network or authentication barriers.

Related Analysis

An administrator finds that all user workstations and server

A-Grade

The CIRT is reviewing an incident that involved a human reso

A-Grade

A company has begun labeling all laptops with asset inventor

S-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide