200-201 Question 228
Select 2A cybersecurity analyst is investigating an alert about repeated failed login attempts on a company server. The analyst needs to determine the origin of the event and its associated source technology. Given the event details, which source technologies are most likely to have generated the event data?
- A
Firewall
- B
Intrusion Detection System (IDS)
- C
Authentication Server (e.g., Active Directory)
- D
Endpoint Detection and Response (EDR)
- E
Web Application Firewall (WAF)
Show answer and explanation
Correct answers: C, D
Explanation
Failed login attempts are related to authentication and endpoint activity. Authentication Servers (e.g., Active Directory) generate logs for login events, including failed attempts, as they manage user authentication. Endpoint Detection and Response (EDR) solutions also monitor failed login attempts on endpoints. While other technologies like Firewalls, IDS, and WAFs may provide related insights, they are not the primary source of such authentication events.
- A. Incorrect.
Firewalls primarily log events related to network traffic, such as blocked or allowed connections, and are unlikely to record failed login attempts unless explicitly configured for such monitoring.
- B. Incorrect.
Intrusion Detection Systems (IDS) monitor network traffic for suspicious patterns but do not typically log authentication-related activities like failed login attempts.
- C. Correct.
Authentication Servers, such as Active Directory, are responsible for managing user identity and access, making them a key source for events related to failed login attempts.
- D. Correct.
Endpoint Detection and Response (EDR) solutions monitor activities at the endpoint level, including failed login attempts, especially if they occur on managed devices.
- E. Incorrect.
Web Application Firewalls (WAF) are designed to protect web applications and may log suspicious web-based authentication attempts but are not typically used to monitor internal server authentication failures.