100-160 Question 154
Single answerYou are a cybersecurity technician tasked with investigating a potential unauthorized access incident. While analyzing the system logs, you notice repeated login attempts from the same IP address followed by a successful login. Which log entry would most likely indicate unauthorized access?
- A
A successful login from a known, authorized user account with a valid IP address.
- B
Multiple failed login attempts followed by a successful login from an unfamiliar IP address.
- C
A single failed login attempt followed by a successful login from a known IP address.
- D
A successful login from a service account during a scheduled maintenance window.
Show answer and explanation
Correct answer: B
Explanation
Unauthorized access can often be identified in system logs by patterns such as multiple failed login attempts followed by a successful login, particularly if the activity originates from an unfamiliar IP address. This behavior is consistent with brute-force attacks where an attacker repeatedly guesses credentials until they succeed.
- A. Incorrect.
This log entry does not indicate suspicious activity since it matches a known user account and valid IP address.
- B. Correct.
This log entry is likely suspicious because the multiple failed attempts followed by success suggest a potential brute-force attack or unauthorized access from an unknown IP.
- C. Incorrect.
A single failed attempt followed by success is not inherently suspicious, especially if the IP address is known.
- D. Incorrect.
This log entry aligns with expected behavior during a scheduled maintenance window and is not indicative of unauthorized access.