300-215 Question 182
Single answerDuring an investigation, you are tasked with analyzing logs from an NGINX web server after a suspected attack. You notice multiple requests in the access logs with the HTTP method 'POST' targeting the '/login' endpoint, followed by a sudden spike in '401 Unauthorized' responses. What could this pattern indicate?
- A
A brute-force attack attempting to guess user credentials
- B
A misconfiguration in the NGINX server causing authentication failures
- C
A legitimate user accidentally entering incorrect login credentials repeatedly
- D
A Distributed Denial of Service (DDoS) attack on the '/login' endpoint
Show answer and explanation
Correct answer: A
Explanation
The pattern of repeated POST requests to the '/login' endpoint followed by '401 Unauthorized' responses strongly suggests a brute-force attack. Brute-force attacks are common tactics used by attackers to guess user credentials by submitting many login attempts with different password combinations. This behavior is distinct from other issues like server misconfigurations, legitimate user errors, or DDoS attacks.
- A. Correct.
Correct. A brute-force attack often involves repeated POST requests to authentication endpoints, such as '/login', with failed login attempts resulting in '401 Unauthorized' responses.
- B. Incorrect.
Incorrect. While a server misconfiguration could cause authentication failures, it would not typically result in a pattern of repeated POST requests followed by a spike in '401 Unauthorized' responses.
- C. Incorrect.
Incorrect. A legitimate user entering incorrect credentials repeatedly is unlikely to cause a significant spike in failed login attempts or the volume of requests observed during an attack.
- D. Incorrect.
Incorrect. A DDoS attack generally generates high traffic volume across multiple endpoints or overwhelms the server, rather than targeting an authentication endpoint with repeated POST requests.