Question 752 of 870
CEH Wireless, IoT and Cloud Security Practice Question
A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?
⚠ Common exam trap
The trap here is that candidates focus on reactive IP-blocking solutions (fail2ban, rate-limiting) or obscurity (port changing) instead of recognizing that the fundamental vulnerability is the use of passwords, which must be eliminated at the protocol level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable password authentication and use SSH key-based authentication.
Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable password authentication and use SSH key-based authentication.
Why this is correct
SSH key-based authentication significantly enhances security against brute-force attacks by relying on cryptographic key pairs instead of guessable passwords. The private key, stored securely on the client, is mathematically linked to a public key on the server, making it virtually impossible to guess or brute-force due to its immense length and complexity. This method eliminates the vulnerability to dictionary attacks and common password cracking techniques, providing a robust defense.
- ✗
Install fail2ban to automatically block IPs after failures.
Why it's wrong here
While fail2ban can mitigate basic brute-force attempts by automatically blocking source IPs after a configurable number of failed logins, it remains vulnerable to distributed attacks. Sophisticated attackers can employ botnets or rotate through a large pool of IP addresses, effectively bypassing the single-IP blocking mechanism. This renders fail2ban less effective against determined, large-scale brute-force campaigns.
- ✗
Implement rate-limiting on SSH connections per IP.
Why it's wrong here
Implementing rate-limiting on SSH connections per IP address offers limited protection against advanced brute-force attacks. Attackers can easily circumvent this defense by distributing their login attempts across a multitude of compromised systems or proxy networks, each presenting a unique IP address. This strategy allows them to stay below the per-IP rate limit while still achieving a high volume of overall login attempts.
- ✗
Change the SSH port to a non-standard port.
Why it's wrong here
Changing the default SSH port (22) to a non-standard port provides only a superficial layer of security, often referred to as 'security by obscurity.' While it might deter casual scanners looking for default services, a determined attacker will simply perform a full port scan of the target system. Tools like Nmap can quickly identify services running on any port, rendering this measure largely ineffective against targeted attacks.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.