100-160 Question 158
Select 3You are a cybersecurity technician investigating a potential security incident. While reviewing the Event Viewer on a Windows server, you notice repeated failed login attempts from a single IP address. Which of the following steps should you take to identify and address the anomaly?
- A
Check the Security logs in Event Viewer for additional details on the failed login attempts.
- B
Ignore the activity, as failed login attempts are common and not necessarily a threat.
- C
Verify the IP address against known malicious IP databases or threat intelligence feeds.
- D
Block the suspicious IP address immediately without further investigation.
- E
Check audit logs for any successful login attempts from the same IP address.
Show answer and explanation
Correct answers: A, C, E
Explanation
Identifying and addressing anomalies in logs requires a systematic approach. Reviewing the Security logs in Event Viewer provides detailed information about the failed login attempts, while cross-referencing the IP address with threat intelligence helps confirm its malicious nature. Checking audit logs for successful logins ensures the investigation covers both unsuccessful and potentially successful intrusion attempts. Ignoring the activity or taking action without proper investigation can lead to either oversight or unnecessary disruptions.
- A. Correct.
Checking the Security logs in Event Viewer is essential to gather more details about the failed login attempts, including the time, source, and impacted accounts.
- B. Incorrect.
Ignoring the activity is not recommended as repeated failed login attempts may indicate a brute force or unauthorized access attempt, which requires investigation.
- C. Correct.
Verifying the IP address against threat intelligence databases can help determine if the source is associated with known malicious activity.
- D. Incorrect.
Blocking the IP address immediately without further investigation may disrupt legitimate traffic if the activity is not malicious or could come from a misconfigured system.
- E. Correct.
Checking audit logs for successful login attempts from the same IP address helps identify if the attacker has already gained access, which is critical in assessing the scope of the threat.