Security Monitoring →mediumMultiple SelectObjective-mapped

200-201 Security Monitoring Practice Question

A security analyst is investigating a potential brute-force attack on an SSH server. Which TWO of the following log sources would provide the most relevant evidence for detecting and confirming this attack? (Choose two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

System logs (authentication events)

System logs contain authentication events (success/failure) which are essential to detect repeated failed SSH logins. Firewall logs show source IPs and ports being accessed (SSH port 22), which can identify the attacking IP. IDS/IPS alerts might detect brute-force patterns but are not the primary source; DNS logs and web server logs are irrelevant to SSH brute-force.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
IDS/IPS alerts (signature name, severity)
Why it's wrong here
IDS/IPS may have signatures for brute-force but are not the most direct log source; system logs are more definitive.
✓
System logs (authentication events)
Why this is correct
System logs record each login attempt (success/failure) and are critical for identifying brute-force patterns.
✓
Firewall logs (allow/deny by source IP/port)
Why this is correct
Firewall logs show traffic to port 22 and can identify the source IP(s) making multiple connection attempts.
✗
Web server logs (HTTP method, URL, response code)
Why it's wrong here
Web server logs are for HTTP/HTTPS traffic, not SSH.
✗
DNS logs (query type, domain queried)
Why it's wrong here
DNS logs are not directly relevant to SSH brute-force attacks.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question