350-201 Question 248
Select 2You are tasked with automating the task of monitoring failed login attempts across multiple servers in your organization's network. A junior analyst provides you with the following Python script, but it requires modification to send an alert to your security team via email if failed login attempts exceed a threshold:
import os
failed_attempts_threshold = 5
log_file = '/var/log/auth.log'
def count_failed_attempts():
with open(log_file, 'r') as file:
logs = file.readlines()
failed_attempts = sum(1 for line in logs if 'Failed password' in line)
return failed_attempts
if count_failed_attempts() > failed_attempts_threshold:
print('Threshold exceeded!')
Which modification(s) should you make to the script to automate the alerting process?
- A
Add an email-sending function using a library like smtplib to send alerts when the threshold is exceeded.
- B
Replace the
print('Threshold exceeded!')line with a call to the email-sending function. - C
Change the log file path to ensure it matches the correct server log location.
- D
Add a function to reset the failed attempts count in the log file after an alert is sent.
- E
Implement a logging mechanism to store alerts in a separate log file for auditing purposes.
Show answer and explanation
Correct answers: A, B
Explanation
To automate the task of alerting the security team when failed login attempts exceed the threshold, the script needs to include functionality to send an email and replace the current print statement with a call to this functionality. Other options, while potentially useful in different scenarios, do not contribute directly to the automation of the alerting process.
- A. Correct.
Correct: To automate sending alerts, an email-sending function is needed. Libraries like smtplib can be used for this purpose.
- B. Correct.
Correct: Replacing the
printstatement with a call to the email-sending function ensures the alert is actually sent to the security team. - C. Incorrect.
Incorrect: While ensuring the log file path is correct is a good practice, it is not part of automating the alerting process.
- D. Incorrect.
Incorrect: Resetting the failed attempts count is unnecessary in this context as the monitoring script reads from a log file that is not modified by the script itself.
- E. Incorrect.
Incorrect: Implementing a logging mechanism is useful for auditing but is not directly related to automating the alerting process.