A security analyst receives an alert that a user account has been locked out after multiple failed login attempts, followed immediately by a successful login from a different geographic location. What is the MOST likely explanation, and what should the analyst investigate?

Question

Accepted Answer

B. The account may have been compromised through credential stuffing or brute force followed by unauthorized access from a different location. The sequence of lockout (from failed attempts) followed by a successful login from a different location is a strong indicator of credential compromise. An attacker may have acquired valid credentials through credential stuffing or brute force and is now authenticated from their own location, while the legitimate user's attempts caused the lockout. The geographic discrepancy requires immediate investigation.

A security analyst receives an alert that a user account has been locked out after multiple failed login attempts, followed immediately by a successful login from a different geographic location. What is the MOST likely explanation, and what should the analyst investigate?

Related Questions

Discussion