100-160 Question 159
Select 3You are a junior cybersecurity technician investigating a potential security incident in a corporate environment. While reviewing the Event Viewer on a Windows system, you notice repeated failed login attempts logged under the Security category. Which steps should you take to identify and address the issue?
- A
Check the source IP address in the audit logs to determine if it originates from an internal or external source.
- B
Ignore the logs, as failed login attempts are common and not a sign of a potential threat.
- C
Verify if the account experiencing failed logins is locked and reset its password if necessary.
- D
Cross-reference the Event Viewer logs with syslog data from network devices to identify patterns.
- E
Immediately block all incoming external traffic to the system to prevent further access attempts.
Show answer and explanation
Correct answers: A, C, D
Explanation
To address repeated failed login attempts, it's important to analyze log data for patterns and potential anomalies, verify the impacted account's status, and correlate findings across multiple sources like syslogs. Ignoring the issue or taking overly drastic actions, such as blocking all traffic, could either miss critical indicators or disrupt legitimate business operations. By following a structured and targeted approach, you ensure the issue is identified and mitigated effectively.
- A. Correct.
Checking the source IP address in the audit logs can help determine whether the failed login attempts are coming from a trusted internal source or a potential external attacker. This is a proactive step in identifying anomalies.
- B. Incorrect.
Ignoring the logs is not a good practice, as repeated failed login attempts could indicate a brute force attack or another malicious activity. Logs should always be analyzed to determine the root cause.
- C. Correct.
Verifying if the account is locked and resetting its password, if necessary, is a critical step. It ensures the integrity and security of the account while keeping the system protected.
- D. Correct.
Cross-referencing Event Viewer logs with syslog data from other devices, such as firewalls or intrusion detection systems, can help identify broader patterns and confirm the scope of the issue.
- E. Incorrect.
Blocking all incoming external traffic is an extreme measure that could disrupt legitimate business operations. Instead, a targeted approach should be taken to address the specific threat.