Courseiva
← CAS-005
Full test
hardMultiple ChoiceObjective-mapped

CAS-004 Practice Question: Based on the exhibit, what type of attack is most…

Exhibit

Refer to the exhibit.

# grep "Failed password" /var/log/auth.log | tail -5
Feb 27 10:23:01 server1 sshd[1234]: Failed password for root from 192.168.1.10 port 22 ssh2
Feb 27 10:23:05 server1 sshd[1235]: Failed password for root from 192.168.1.10 port 22 ssh2
Feb 27 10:23:10 server1 sshd[1236]: Failed password for admin from 10.10.10.5 port 22 ssh2
Feb 27 10:23:15 server1 sshd[1237]: Failed password for root from 192.168.1.10 port 22 ssh2
Feb 27 10:23:20 server1 sshd[1238]: Failed password for user from 172.16.0.20 port 22 ssh2

Based on the exhibit, what type of attack is most likely occurring?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute-force attack

The exhibit shows multiple failed SSH login attempts from various IP addresses with different usernames, which is characteristic of a brute-force attack. Option D is correct. Option A (MITM) is incorrect because there is no evidence of intercepted communication. Option B (phishing) is incorrect as it involves social engineering, not direct authentication attempts. Option C (DDoS) is incorrect because the traffic is aimed at authentication, not overwhelming the network.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Man-in-the-middle (MITM) attack

    Why it's wrong here

    MITM would involve interposition, not authentication failures.

  • ✗

    Phishing attack

    Why it's wrong here

    Phishing is social engineering via email, not direct SSH attempts.

  • ✗

    Distributed denial-of-service (DDoS) attack

    Why it's wrong here

    DDoS would show high volume of traffic, not repeated login attempts.

  • ✓

    Brute-force attack

    Why this is correct

    The log shows repeated failed authentication attempts, typical of brute force.

About these practice questions

This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on CAS-005

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Based on the exhibit, which type of attack is most likely occurring?

hard
  • A.Pass-the-hash attack
  • B.Account lockout attack
  • C.Replay attack
  • ✓ D.Brute force password guessing

Why D: The exhibit shows a high number of failed authentication attempts (e.g., Event ID 4625) from a single source IP against multiple user accounts over a short period. This pattern is characteristic of a brute force password guessing attack, where an attacker systematically tries common passwords against many accounts to gain unauthorized access. The absence of successful logins or account lockouts further supports this conclusion.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.