200-201 Question 227
Select 2A security analyst is investigating a series of unusual login attempts to a company's internal systems. The log data indicates failed login attempts from multiple IP addresses within a short time frame. The security operations team needs to determine which source technology generated the logs to further analyze the incident. Based on the description, which source technologies are most likely responsible for producing these logs?
- A
Firewall
- B
Intrusion Detection System (IDS)
- C
Authentication Server
- D
Web Proxy
- E
SIEM (Security Information and Event Management)
Show answer and explanation
Correct answers: A, C
Explanation
Failed login attempt logs are typically produced by authentication servers, as they manage and monitor user authentication processes. Firewalls may also log related activity, such as unauthorized connection attempts, making them a potential source of relevant data in this scenario. Other technologies like IDS, web proxies, or SIEM systems do not directly generate these types of logs but instead analyze or aggregate data from other sources.
- A. Correct.
Firewalls generate logs related to network traffic, including blocked and allowed connections, but they typically do not focus on login attempts or authentication failures.
- B. Incorrect.
Intrusion Detection Systems (IDS) monitor for malicious activity or rule violations, but they do not handle or log authentication events directly.
- C. Correct.
Authentication servers, such as Active Directory or RADIUS, are responsible for managing user authentication and are the primary source of logs for failed or successful login attempts.
- D. Incorrect.
Web proxies are used to manage and log web traffic, not authentication events, so they are unlikely to be the source of failed login attempt logs.
- E. Incorrect.
SIEM systems aggregate and correlate logs from various sources but do not directly generate logs. They rely on input from technologies such as authentication servers or firewalls.