An analyst is reviewing application logs to identify unauthorized access to confidential files. Which of the following BEST indicates an incident that requires immediate investigation?
Multiple failed login attempts followed by a successful login in a short time frame.
Frequent connection errors to the database server from an application's service account.
A single failed login attempt from a known user's IP address.
Repeated application time-outs during peak business hours.