200-201 Question 212
Single answerA security analyst is monitoring logs in a Security Information and Event Management (SIEM) system and notices multiple failed login attempts from a single IP address targeting a critical internal server. The analyst needs to determine if this is an event worth investigating further. Based on cybersecurity principles, how should the analyst classify this observation?
- A
This is an event because it represents a deviation from normal activity.
- B
This is an incident because it clearly indicates a successful compromise of the server.
- C
This is not an event because failed login attempts are common and not necessarily malicious.
- D
This is an event because it could indicate a potential brute-force attack.
Show answer and explanation
Correct answer: A
Explanation
In cybersecurity, an event is defined as any observable occurrence in a system or network. The repeated failed login attempts from a single IP address targeting a critical server deviate from normal behavior and should be classified as an event. This classification allows the security team to investigate further and determine if it represents a threat or benign activity.
- A. Correct.
Correct: This is an event because a series of failed login attempts is a deviation from normal activity and should be investigated further.
- B. Incorrect.
Incorrect: This is not classified as an incident since there is no evidence of a successful compromise at this stage.
- C. Incorrect.
Incorrect: While failed login attempts can occur frequently, multiple consecutive attempts from a single IP targeting a critical server warrant classification as an event.
- D. Incorrect.
Incorrect: While this behavior could indicate a brute-force attack, the question specifically asks about what constitutes an event, not a specific attack type.