100-160 Question 151
Single answerYou are a cybersecurity technician reviewing system logs from a web server. The log contains repeated entries showing failed login attempts from the same IP address within a short timeframe. What is the most likely explanation for this activity?
- A
A brute-force attack attempting to guess user credentials
- B
A legitimate user mistyping their password multiple times
- C
A scheduled system update causing login errors
- D
A normal background process generating authentication logs
Show answer and explanation
Correct answer: A
Explanation
The repeated failed login attempts from the same IP address strongly indicate a brute-force attack. This is a common type of attack where an adversary uses automated tools to attempt to guess user credentials through trial and error. Recognizing such patterns in system logs is a critical skill for cybersecurity technicians to identify potential threats.
- A. Correct.
This is the correct answer. Repeated failed login attempts from the same IP address are a common indicator of a brute-force attack, where an attacker tries multiple password combinations to gain unauthorized access.
- B. Incorrect.
While it's possible that a legitimate user could mistype their password, the repeated and rapid nature of the failed login attempts makes this explanation less likely.
- C. Incorrect.
Scheduled system updates do not typically generate repeated failed login attempts. If there were an issue with an update, it would likely appear as a different type of error in the logs.
- D. Incorrect.
Normal background processes do not generate repeated failed login attempts. Authentication logs triggered by background processes would not indicate malicious activity unless combined with other suspicious patterns.