easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Is a common indicator of a brute-force attack on…
Which of the following is a common indicator of a brute-force attack on an SSH server?
⚠ Common exam trap
Cisco often tests the distinction between a single failed login (normal) and a pattern of repeated failures (attack), leading candidates to mistakenly choose Option A because they focus on the word 'failed' rather than the volume and pattern of attempts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Repeated login attempts with different usernames and passwords in a short period.
A brute-force attack on an SSH server is characterized by a high volume of authentication attempts, typically using different usernames and passwords, in a short time window. This pattern aims to guess valid credentials through repeated trial and error, which is distinct from a single failure or a few successful logins. The rapid, automated nature of the attempts is the key indicator that distinguishes brute-force activity from normal user behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single failed login attempt.
Why it's wrong here
A single failure is often a user mistake, not a brute-force attack.
- ✗
Multiple successful logins from the same user.
Why it's wrong here
Multiple successful logins could indicate a shared account, not necessarily brute-force.
- ✓
Repeated login attempts with different usernames and passwords in a short period.
Why this is correct
This pattern matches brute-force attacks trying to guess credentials.
- ✗
High CPU usage on the server.
Why it's wrong here
High CPU can have many causes, not specific to brute-force.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.