CND Network Attacks And Defense Strategies Practice Question
A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.
Fail2ban monitors log files (such as /var/log/auth.log) for patterns of failed authentication attempts and automatically updates firewall rules (iptables or nftables) to ban offending IP addresses for a set duration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy Wireshark with a real-time command-line display filter for SSH packets.
Why it's wrong here
Wireshark is an interactive packet analyzer, not an active log-monitoring intrusion prevention daemon.
- ✗
Execute 'tcpdump' with a packet filter expression capturing TCP port 22 traffic.
Why it's wrong here
tcpdump captures packets for analysis, but does not block IP addresses automatically.
- ✓
Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.
Why this is correct
Fail2ban automates log analysis and dynamic firewall blocking for brute-force mitigation.
- ✗
Enable the Linux auditd daemon and review audit logs manually using the ausearch utility.
Why it's wrong here
auditd records system events for review, but does not actively or dynamically block IP addresses.
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.