300-215 Question 118
Select 3During a routine review of SIEM logs, you observe a high volume of failed login attempts to a critical server within a short time frame. Further inspection reveals that these attempts originated from multiple IP addresses across different geographic locations. Which log event details are most critical to identify whether this is a brute force attack?
- A
The timestamp of each failed login attempt
- B
The geographic location of the source IP addresses
- C
The number of successful login attempts from the same IP addresses
- D
The type of authentication method used by the server
- E
The username being targeted in the login attempts
Show answer and explanation
Correct answers: A, B, E
Explanation
A brute force attack typically involves rapid, repeated failed login attempts from multiple sources. By analyzing the timestamps, the geographic locations of the IPs, and the usernames being targeted, you can identify patterns consistent with a brute force attack. While other details, like authentication methods or successful logins, are useful for broader investigations, they are not critical for this specific scenario.
- A. Correct.
The timestamp of each failed login attempt is critical for identifying patterns, such as rapid failed attempts, which are indicative of a brute force attack.
- B. Correct.
The geographic location of the source IP addresses can help determine if the activity is suspicious, as brute force attempts often originate from multiple global locations.
- C. Incorrect.
The number of successful login attempts is not directly relevant to determining if this is a brute force attack, as the focus should be on failed attempts.
- D. Incorrect.
The authentication method is useful for broader security assessments but does not directly indicate a brute force attack.
- E. Correct.
The username being targeted provides vital information about whether the attack is attempting to compromise a specific account.