easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Based on the auth.log exhibit, what is the MOST…
Exhibit
Refer to the exhibit. ``` # auth.log excerpt Mar 15 10:23:45 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:46 server sshd[1235]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:47 server sshd[1236]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:48 server sshd[1237]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:49 server sshd[1238]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:50 server sshd[1239]: Failed password for invalid user admin from 192.168.1.100 port 22 ssh2 Mar 15 10:23:51 server sshd[1240]: Failed password for admin from 192.168.1.100 port 22 ssh2 Mar 15 10:23:52 server sshd[1241]: Failed password for admin from 192.168.1.100 port 22 ssh2 ```
Based on the auth.log exhibit, what is the MOST appropriate immediate action to mitigate this attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure fail2ban to block the IP address after a threshold of failed attempts.
The log shows a brute-force attack against SSH. Installing fail2ban will dynamically block the IP after multiple failures. Option A is too broad and may block legitimate users from that subnet. Option B doesn't address the immediate attack. Option D is good practice but does not stop the ongoing attack immediately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable root login and remove the admin account.
Why it's wrong here
These are long-term hardening steps but won't stop the ongoing attack immediately.
- ✗
Block the entire 192.168.1.0/24 subnet at the firewall.
Why it's wrong here
Blocking the whole subnet may affect other legitimate hosts.
- ✓
Configure fail2ban to block the IP address after a threshold of failed attempts.
Why this is correct
fail2ban automatically blocks the attacking IP, stopping the attack.
- ✗
Change the SSH port to a non-standard port.
Why it's wrong here
Changing the port may reduce automated scans but won't prevent this specific attack from the same IP.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.