100-160 Question 153
Single answerA cybersecurity technician is tasked with reviewing system logs after a suspected breach. Upon examining the logs, they notice repeated failed login attempts from an unknown IP address followed by a successful login using an administrator account. What action should the technician take based on this log entry?
- A
Investigate the unknown IP address and block it immediately.
- B
Ignore the activity as it is likely a false positive.
- C
Change the administrator account password and monitor for further activity.
- D
Disable the administrator account and delete the logs to prevent further breaches.
Show answer and explanation
Correct answer: C
Explanation
Interpreting system logs is critical in identifying potential security incidents. In this scenario, the logs reveal a successful breach using an administrator account. The priority should be to secure the compromised account by changing its password and monitoring for further suspicious behavior. Blocking the IP address is secondary and can follow after immediate containment steps.
- A. Incorrect.
Investigating and blocking the IP address is a good security practice but does not address the immediate issue of the compromised administrator account.
- B. Incorrect.
Ignoring the activity is inappropriate, as the log clearly indicates a successful breach using the administrator account.
- C. Correct.
Changing the administrator account password and monitoring for further activity is the most appropriate immediate response to secure the account and identify any ongoing threats.
- D. Incorrect.
Disabling the administrator account might disrupt operations, and deleting logs is not recommended as it hinders investigation and forensics.