Exam SY0-701 topic 1 question 356 discussion

User Activity logs will show when he tried to log in. They arent trying to prevent or it would be 2FA. Key word "DETECT"

User activities logs are not stored in a single location - they are distributed across different logs and systems for different types of activities and security events. The user activities log can be founds in the following logs: Event Viewer Security logs Application logs System logs Setup logs Active Directory logs Domain controller logs Authentication logs Policy change logs Application-specific logs IIS web server logs SQL Server logs Exchange Server logs Azure/Cloud logs Azure AD sign-in logs Cloud service logs Resource access logs

User activity logs track user actions, including failed login attempts, unauthorized access attempts, and unusual activity. In this scenario, logging would record the employee's repeated attempts to guess system administrator credentials, which could then be reviewed and flagged as suspicious behavior. By analyzing these logs, security teams can detect and investigate potential unauthorized access attempts.