312-39V2: Certified SOC Analyst v2

Question

David Reynolds, a SOC analyst at a healthcare organization, is investigating a sequence of suspicious login attempts identified by the SIEM (Security Information and Event Management) system. To reduce the risk of brute-force attacks against the target endpoints, he works with the IT team to implement an automatic account lockout policy. The policy temporarily disables user accounts after multiple failed login attempts, stopping attackers from repeatedly guessing passwords to obtain unauthorized access. Within the SOC’s eradication strategy, which category of measures does this action align with?

Explanation

Automatic account lockout limits unsuccessful logon attempts by temporarily preventing further authentication after a defined threshold is exceeded. This mitigates repeated password guessing and is an authentication and authorization measure. NIST SP 800-53 control AC-7 covers automatic account locking or other actions after excessive unsuccessful logon attempts.

Learn more

NIST SP 800-53 Baseline Reviewer — AC-7 Unsuccessful Logon Attempts

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ21

Community Discussion