100-160 Question 155
Single answerYou are a cybersecurity technician investigating a potential security incident involving unauthorized access to a server. Upon reviewing system logs, you notice repeated failed login attempts from the same IP address followed by a successful login. Which log entry would most likely confirm a brute force attack?
- A
A series of failed login attempts followed by a successful login from the same IP address.
- B
A single successful login from a known administrator account.
- C
A series of login attempts from different IP addresses using the same credentials.
- D
A log entry showing a password change request for a user account.
Show answer and explanation
Correct answer: A
Explanation
A brute force attack involves repeatedly attempting to guess a password for an account. System logs showing repeated failed login attempts followed by a successful login from the same IP address are strong indicators of such an attack. Recognizing these patterns in logs is critical for identifying and mitigating security incidents.
- A. Correct.
This pattern is indicative of a brute force attack, where multiple failed attempts are made to guess a password, and a successful login suggests the attacker guessed the correct password.
- B. Incorrect.
A single successful login from a known administrator account is normal behavior and does not indicate a brute force attack.
- C. Incorrect.
A series of login attempts from different IP addresses using the same credentials is more indicative of a credential stuffing attack rather than a brute force attack.
- D. Incorrect.
A password change request for a user account is not directly related to a brute force attack and may indicate other account activity.