100-160 Question 152
Single answerA cybersecurity analyst has been tasked with investigating unusual traffic on a company's network. Upon reviewing the system logs, they notice repeated failed login attempts from a single IP address over a short time. What is the most likely interpretation of this log entry?
- A
A brute force attack is being attempted on a user account.
- B
The user is experiencing connectivity issues causing failed logins.
- C
A database query error is resulting in failed login messages.
- D
An authorized user is logging in from multiple devices simultaneously.
Show answer and explanation
Correct answer: A
Explanation
Repeated failed login attempts from the same IP address often indicate a brute force attack, where an attacker systematically attempts to guess a user's password. It is important to recognize this pattern in logs to take timely action, such as blocking the suspicious IP address or implementing stricter account lockout policies.
- A. Correct.
Repeated failed login attempts from a single IP address over a short period are indicative of a brute force attack, where an attacker tries multiple passwords to gain unauthorized access.
- B. Incorrect.
Connectivity issues usually result in intermittent or sporadic login failures, not repeated attempts from the same IP address in a short time frame.
- C. Incorrect.
Database query errors are unrelated to login attempts and would typically generate different types of log entries, not failed login messages.
- D. Incorrect.
An authorized user logging in from multiple devices wouldn't generate repeated failed login attempts from a single IP address.