medium10 pts · first answer countssiemalert-triagewindows-logs

Failed logons followed by success

A SIEM shows 300 Event ID 4625 entries for the account j.kumar from one external IP within 10 minutes, followed by one 4624 for the same account from the same IP. What is the most likely conclusion?

A.The user forgot their password and the helpdesk reset itB.A likely successful brute force attack; treat the account as compromised and investigateC.Normal behaviour for VPN users, so the alert can be closedD.A Kerberos ticket expired, which always produces these events

Discussion 0

Join free to post in the discussion.

Failed logons followed by success

Discussion 0

Related questions