Level 3 - IntermediateScenario-Based Questions
Scenario: Failed Login Risk Alert
Security team needs users with 5+ failed login attempts in the last 24 hours and no successful login in the same window. Return user_id and failed_count.
Schema Context
login_events(id, user_id, event_time, status) -- status in ('SUCCESS','FAILED')