312-39V2: Certified SOC Analyst v2

A SOC analyst monitoring authentication logs observes a sudden, substantial increase in failed login attempts against multiple critical servers outside business hours. The repeated authentication failures are abnormal compared with normal login activity. Further inspection shows that every attempt originates from one external IP address, indicating a targeted attack rather than random scanning. Some attempts use legitimate employee usernames, raising the possibility of credential stuffing with previously compromised credentials or an ongoing brute-force attempt. Given this suspicious activity and its potential to escalate into unauthorized access, the analyst must identify the appropriate next step in the threat-hunting process to further assess the situation.