Account Attacks and IAM Monitoring

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Account Attacks and IAM Monitoring

Key Takeaways Explain This Topic AI

Credential attacks include password spraying, credential stuffing, brute force, phishing, and MFA fatigue (push bombing).

Password spraying tries a few common passwords across many accounts to stay under lockout thresholds.

Credential stuffing replays username/password pairs leaked from another breach.

IAM monitoring correlates authentication, MFA, directory audit, and cloud control-plane logs for context.

Account-takeover response prioritizes session revocation, credential reset, MFA review, and privilege-change inspection over training.

Last updated: June 2026

Identity Is the New Perimeter

Many incidents begin with a credential. A valid username and password make attacker activity look like normal access unless monitoring weighs context: source IP, time, device posture, token, geolocation, MFA behavior, and privilege changes. SY0-701 expects you to distinguish the attack patterns by their log signature and to choose the containment action that stops an active takeover.

Common Account Attacks

• Attack Pattern Detection clue
• Brute force Many guesses against one account High failure count for one username
• Password spraying One/few passwords against many accounts Same password attempt across many users from one IP
• Credential stuffing Leaked username/password pairs replayed Successes from odd sources after automation
• Phishing User reveals credential or approves access New device, suspicious link, unexpected MFA
• MFA fatigue (push bombing) Repeated push prompts until approval Many denials then a success
• Token theft / pass-the-cookie Reused session or refresh token Login without the normal MFA path

Account lockout is the standard brute-force defense. A common policy locks an account after roughly 5 failed attempts within a short window , which is precisely why spraying limits itself to one or two passwords per account, staying under the threshold. Knowing that trade-off explains why spraying is the answer when failures spread across users rather than concentrate on one.

Realistic Log Snippets

Password spraying (one IP, one password, many users): 2026-06-14T09:10:02Z auth result=fail user=amiller source_ip=203.0.113.44 reason=bad_password

• 2026-06-14T09:10:03Z auth result=fail user=bchen source_ip=203.0.113.44 reason=bad_password
• 2026-06-14T09:10:04Z auth result=fail user=ckhan source_ip=203.0.113.44 reason=bad_password
• 2026-06-14T09:10:05Z auth result=fail user=dross source_ip=203.0.113.44 reason=bad_password

MFA fatigue (repeated denials then approval): 2026-06-14T22:41:11Z mfa user=jprice method=push result=denied source_ip=198.51.100.88

• 2026-06-14T22:41:50Z mfa user=jprice method=push result=denied source_ip=198.51.100.88
• 2026-06-14T22:42:31Z mfa user=jprice method=push result=denied source_ip=198.51.100.88
• 2026-06-14T22:43:04Z mfa user=jprice method=push result=approved source_ip=198.51.100.88

Privilege escalation right after the suspicious login: 2026-06-14T22:45:19Z directory action=add_member actor=jprice target_group=Cloud-Admins target_user=jprice result=success

The last event changes everything. A suspicious login is notable; a suspicious login followed by self-added admin rights is an urgent active takeover.

Monitoring Signals

Good IAM monitoring fuses authentication logs, MFA logs, directory audit logs, endpoint posture, cloud control-plane activity, and PAM events. High-value detections include:

Many failed logins across many users from one IP (spraying).

A success immediately after a burst of failures (stuffing/brute force).

New privileged group membership.

Impossible travel or an unusual country for the user.

Sign-in from an unmanaged or non-compliant device.

An MFA method reset followed by a successful login.

A service account logging in from an unfamiliar host.

An OAuth consent grant to a suspicious application.

Response Walkthrough

An analyst sees repeated MFA prompts for jprice, then a success from an unfamiliar source, then a self-add to Cloud-Admins. Correct containment order: revoke active sessions and refresh tokens, disable or force-reset the account per policy, re-enroll/verify MFA methods, inspect and roll back recent privilege changes, and review every action taken after the success. User-awareness training is valuable long term but does not contain the live threat.

Common Traps

Treating a successful MFA event as automatically safe (fatigue/token theft defeat it).

Watching failed logins while ignoring privilege changes after a success.

Resetting the password but leaving sessions and refresh tokens valid.

Ignoring service accounts because they have no mailbox.

Blocking one IP without checking whether the credentials were reused elsewhere.

Hardening That Stops These Attacks

Knowing the attack is half the exam; knowing the matching control is the other half. Phishing-resistant MFA such as FIDO2 security keys or passkeys defeats both phishing and MFA fatigue because there is no push to spam and no code to relay. Number matching on push prompts blunts fatigue by forcing the user to type a code shown on the login screen, so blind approvals fail. Account lockout and exponential backoff slow brute force, while a CAPTCHA or device-fingerprint challenge slows automated stuffing.

Defending against credential stuffing specifically means breaking the reuse chain: enforce breached-password screening, require unique passwords, and deploy a password manager -friendly policy. Because stuffing relies on passwords leaked elsewhere, MFA is the strongest single mitigation, but token-binding and conditional access add depth.

UEBA and Risk-Based Authentication

User and entity behavior analytics (UEBA) builds a baseline for each identity, then flags deviations: a finance clerk suddenly running PowerShell against a domain controller, or a login at 3 a.m. from a new country. Risk-based (adaptive) authentication turns those scores into action, stepping up to MFA or blocking outright when risk is high and staying frictionless when risk is low. On the exam, when a stem describes "unusual but technically valid" activity, the behavioral-analytics answer beats a static rule.

Triage Priority Table

• Signal observed Severity First action
• Spray failures across many users Medium Block source, hunt for any success
• Success after failure burst High Revoke sessions, reset credential
• MFA fatigue then approval High Revoke sessions, re-enroll MFA
• New admin group membership Critical Roll back change, full IR

The escalation logic mirrors how a SIEM correlation rule should be tuned, and it is exactly the prioritization SY0-701 scenario questions reward.