200-201 Question 203
Single answerA security analyst is investigating an incident where unauthorized access to a server occurred. The analyst reviews the following log entry from the server:
Oct 15 15:23:45 server1 sshd[12345]: Failed password for invalid user admin from 192.168.1.50 port 54321 ssh2
Based on this log, what type of evidence does this entry provide?
- A
Authentication evidence
- B
Network evidence
- C
File system evidence
- D
Process evidence
Show answer and explanation
Correct answer: A
Explanation
This log entry provides evidence related to an authentication event, specifically a failed SSH login attempt. It includes details such as the user attempting access, the source IP address, and the nature of the failure. This makes it authentication evidence, as it focuses on access control rather than network activity, file system interactions, or process states.
- A. Correct.
Authentication evidence is correct because this log entry records an authentication attempt (failed password) and includes details about the user, source IP, and access method (SSH).
- B. Incorrect.
Network evidence is incorrect because while the log includes an IP address, the primary focus of the log is authentication, not network activity or traffic flow.
- C. Incorrect.
File system evidence is incorrect because the log entry does not reference any files or interactions with the file system.
- D. Incorrect.
Process evidence is incorrect because the log entry does not detail any specific processes or their states, even though it mentions the SSH daemon (sshd).