mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security analyst reviews this output from an…
Exhibit
Refer to the exhibit. ``` C:\.ssh> ssh admin@192.168.1.100 admin@192.168.1.100's password: Permission denied, please try again. admin@192.168.1.100's password: Permission denied, please try again. admin@192.168.1.100's password: Received disconnect from 192.168.1.100 port 22:2: Too many authentication failures Authentication failed. ```
A security analyst reviews this output from an SSH session. What security control is in place on the remote server?
⚠ Common exam trap
The CAS-004 exam often tests the distinction between server-side connection termination (MaxAuthTries) and account-level lockout or external IP blocking, leading candidates to confuse a per-connection limit with a per-account or firewall-based control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MaxAuthTries limit in SSH configuration
The output shows repeated 'Permission denied' messages followed by 'Connection closed by remote host' after a specific number of attempts. This behavior is characteristic of the MaxAuthTries directive in the SSH server configuration (sshd_config), which limits the number of authentication attempts per connection. When the limit is reached, the SSH server immediately closes the connection, as seen in the output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Account lockout policy
Why it's wrong here
Account lockout would prevent further attempts after a set number, but the message indicates per-connection limit.
- ✓
MaxAuthTries limit in SSH configuration
Why this is correct
The SSH server's MaxAuthTries setting limits the number of authentication attempts per connection.
- ✗
Fail2ban or similar IP blocking
Why it's wrong here
IP blocking would show a different error or connection timeout.
- ✗
SSH banner
Why it's wrong here
A banner would appear before authentication.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.