Which of the following is the best approach for the administrator to troubleshoot this issue?

A user’s assigned cloud credentials are locked, and the user is unable to access the project’s application. The cloud administrator reviews the logs and notices several attempts to log in with the user’s account were made to a different application after working hours.

Which of the following is the best approach for the administrator to troubleshoot this issue?
A . Create new credentials for the user and restrict access to the authorized application.
B . Track the source of the log-in attempts and block the IP address of the source in the WAR
C . Reset the user’s account and implement a stronger lock-out policy.
D . Install an IDS on the network to monitor suspicious activity

View Answer

Answer: B

Explanation:

The administrator should track the source of the log-in attempts and block the IP address in the Web Application Firewall (WAF). This will prevent further unauthorized attempts from that source. It is also advisable to reset the user’s account credentials as a precautionary measure.

Reference: Incident response and addressing unauthorized access attempts, including tracking and blocking IP addresses, are security measures addressed in the CompTIA Cloud+ material.