easyMultiple Choice
Mitigating SSH Brute Force Attacks: Firewall Deny and Allow Lists
Exhibit
Refer to the exhibit. ``` # auth.log excerpt Mar 15 10:23:45 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:46 server sshd[1235]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:47 server sshd[1236]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:48 server sshd[1237]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:49 server sshd[1238]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:23:50 server sshd[1239]: Failed password for invalid user admin from 192.168.1.100 port 22 ssh2 Mar 15 10:23:51 server sshd[1240]: Failed password for admin from 192.168.1.100 port 22 ssh2 Mar 15 10:23:52 server sshd[1241]: Failed password for admin from 192.168.1.100 port 22 ssh2 ```
Based on the auth.log exhibit, what is the MOST appropriate immediate action to mitigate this attack?
⚠ Common exam trap
The trap is choosing a broad or permanent solution (like blocking a subnet or changing ports) instead of a targeted, automated response that directly mitigates the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure fail2ban to block the IP address after a threshold of failed attempts.
Configuring fail2ban to block the IP address after a threshold of failed attempts is the most appropriate immediate action because it dynamically mitigates brute-force attacks by temporarily banning offending IPs. This approach is targeted and automated, reducing the attack surface without disrupting legitimate users. It directly addresses the observed repeated failed login attempts in the auth.log.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable root login and remove the admin account.
Why it's wrong here
Disabling root login and deleting the admin account removes the targeted credentials but leaves the attack channel open; the log shows repeated authentication attempts that require blocking the source or applying rate limits. It tempts because eliminating privileged accounts is sound hardening, and would suffice if the attack relied solely on those credentials.
- ✗
Block the entire 192.168.1.0/24 subnet at the firewall.
Why it's wrong here
Blocking the whole /24 severs every host on that subnet, including legitimate users, because the attack originates from a single compromised address within it. Firewall subnet blocks suit containing an entire untrusted network segment, not isolating one offending host identified in the log.
- ✓
Configure fail2ban to block the IP address after a threshold of failed attempts.
Why this is correct
Fail2ban parses auth.log and dynamically inserts firewall rules to drop the source IP once failed authentication attempts cross a threshold, immediately throttling the brute-force source while legitimate users retain access, and it is reversible once the attack subsides.
- ✗
Change the SSH port to a non-standard port.
Why it's wrong here
Moving SSH to a non-standard port only evades opportunistic scanners; the exhibit shows a targeted brute-force against a valid account, which continues regardless of port. It tempts because port obfuscation reduces background noise, and would be reasonable hardening alongside, not instead of, blocking the source and locking the account.
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.