CSA (312-39) SOC Simulation Lab

Welcome to the SOC. Today you are responding to an active identity-based attack targeting healthcare infrastructure. You will learn how to evaluate containment options balancing security efficacy against operational availability.

🔬 Scenario Context

You are a Tier 3 SOC Analyst at MedCorp Health. Your L1 team escalated an incident involving a sudden, massive spike in failed authentications targeting the organization's external VPN portal. The attacks are originating from a rotating pool of IP addresses (likely a botnet or proxy network). Because this is a critical hospital environment, doctors and nurses require 24/7 remote access. You cannot simply pull the plug on external access without disrupting patient care.

📊 Security Environment

SIEM Query: Splunk SPL

index=windows sourcetype="XmlWinEventLog:Security" EventCode=4625 | stats count by TargetUserName, IpAddress, WorkstationName | where count > 50 | sort - count

Telemetry Output (Snippet)

Time TargetUserName IpAddress Count Status 2023-10-24 08:12:01 jsmith 192.168.x.x [Ext] 412 0xC000006A (Bad Password) 2023-10-24 08:12:05 mchen 203.0.113.45 389 0xC000006A 2023-10-24 08:12:08 admin 198.51.100.12 850 0xC0000064 (User not found) -- ALERT: MITRE ATT&CK T1110.003 (Password Spraying) Threshold Exceeded --

⚠️ Question

At a large healthcare organization, the Security Operations Center (SOC) detects a surge of failed login attempts on employee accounts, indicating a possible brute-force attack. To contain the threat, the team quickly takes action to prevent unauthorized access. However, they also need to implement a security measure that strengthens account protection beyond just stopping the current attack, reducing the risk of similar incidents in the future. During the Containment Phase, which action would best enhance long-term account security against brute-force attacks?

SOC Analyst Hint: Look at the phrase "strengthens account protection beyond just stopping the current attack, reducing the risk of similar incidents in the future." Which of these structurally changes how authentication works so that guessing a password is no longer enough?

🧠 Expert Insight: Senior SOC Analyst Debrief

1. What is happening?

The SIEM has detected a high volume of Event ID 4625 (Failed Logon) pointing to a brute-force or password spraying attack (MITRE T1110). Because the source IPs are external and targeting multiple accounts, the adversary is attempting to harvest valid credentials to gain initial access to the healthcare network.

2. Why the correct answer is correct (Option D)

Enable multi-factor authentication (MFA) is the correct answer. While incident response typically frames MFA implementation as part of the Eradication or Post-Incident Activity phases, many security frameworks (and the CSA exam) recognize enabling MFA as the definitive "long-term containment" strategy for identity attacks. MFA breaks the attack chain: even if the brute-force attack eventually guesses the correct password, the adversary cannot authenticate without the second factor (token, push notification, biometrics). It provides structural, future-proof resilience.

3. Why the other options are wrong

A. Notify affected users: Communication is important, but it is not a technical containment control. It does not stop an active attack or prevent future ones.
B. Block IP and enforce account lockout policies: Blocking IPs is a short-term tactical fix (attackers simply rotate IPs via proxies). Enforcing strict account lockouts in a healthcare environment is extremely dangerous. It allows the attacker to cause a Self-Inflicted Denial of Service (DoS), locking doctors out of patient records during emergencies.
C. Cross-verify false positives: This is an investigative action performed during the Detection and Analysis phase, not a containment action.

4. Real-world SOC Application

In modern SOC operations, identity is the new perimeter. When we see a brute-force attack on an external gateway (like an F5 Big-IP VPN or Microsoft 365), L1 analysts might apply temporary IP blocks (Geo-blocking or Tor node blocking) as immediate short-term containment. However, the L3 engineers will immediately pivot to identity controls. If a user is targeted, we revoke their active session tokens and enforce an MFA re-registration, ensuring that the compromised password cannot be leveraged.

💡 MINI LESSON: The "Account Lockout" Trap

A common mistake junior analysts make is assuming "Account Lockout" is the best defense against brute force. In reality, modern adversaries use Password Spraying specifically to bypass lockout policies. They try one common password (e.g., Autumn2023!) across thousands of accounts, staying below the typical 3-to-5 failed attempt threshold. If you lower the threshold to stop them, the attacker will intentionally spam bad passwords to lock out your entire active directory, taking down business operations. Always prefer MFA and conditional access over strict lockout policies.

Want to improve your detection logic and IR workflow?

Explore more CSA simulations at ExamRange →