Browser LabLD-SOC1-ASSESS-001Medium
Browser LabLD-SOC1-ASSESS-001Medium30 min
Module 01 Assessment — Part B: The Recurring Lockout
An employee has reported being locked out four times this week. The service desk escalated it to the SOC as possible account attack. Three explanations are consistent with a repeated lockout: an attacker guessing the password, a stale credential cached on a device, or the user mistyping. Decide which the evidence actually supports.
What you will be able to do
- Distinguish between three explanations that produce the same surface symptom.
- Use source and timing to eliminate hypotheses rather than confirm a favourite.
- Recommend an action proportionate to the finding.
Incident TriageLog AnalysisWindows SecurityAnalyst Reporting
Sign in to start this lab.
Sign in