Preventing SSH Brute Force: Account Lockout
Exhibit
Refer to the exhibit. syslog output: Mar 15 10:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:46 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:47 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:48 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:49 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Based on the exhibit, which control is most likely missing to prevent this type of event?
Quick Answer
The answer is implementing account lockout after three failed attempts. This control directly prevents SSH brute force attacks by halting further login attempts once a threshold is exceeded, effectively stopping the attacker regardless of password strength or system patching. On the CISA exam, this scenario tests your understanding of preventive controls versus detective or corrective measures—a common trap is choosing stronger passwords or disabling SSH, but account lockout is the specific, proactive barrier that blocks the brute force method itself. Remember, the key distinction is that lockout stops the attack in progress, while other options only reduce its impact or detect it after the fact. A useful memory tip: “Three strikes and you’re out” directly maps to the three-failed-attempt lockout threshold.
⚠ Common exam trap
A common mix-up: candidates choose 'Disabling direct root login via SSH' (Option C) because it is a well-known security best practice, but it does not prevent brute-force attacks against other user accounts, whereas account lockout directly stops the attack mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing account lockout after three failed attempts
The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Applying the latest security patches to the SSH service
Why it's wrong here
Patch management addresses software vulnerabilities, not the unauthorised access shown in the exhibit. If the event stemmed from weak authentication, exposed credentials or misconfigured access, patching the SSH service would not prevent it. Patching is the correct control when the incident exploits a known unpatched vulnerability.
- ✓
Implementing account lockout after three failed attempts
Why this is correct
Account lockout after three failed attempts blocks continued password guessing against the same account, directly preventing the brute-force authentication event shown. This satisfies the control gap by throttling repeated failures rather than merely logging or alerting on them.
- ✗
Disabling direct root login via SSH
Why it's wrong here
Disabling direct root login via SSH does not address the exhibit's event, which occurs through a different access path or vulnerability than root SSH authentication. It is tempting because it is a genuine hardening step, and would be correct where the exhibit showed attackers authenticating as root over SSH.
- ✗
Enforcing strong password complexity
Why it's wrong here
Strong password complexity cannot stop the event shown, which stems from an unpatched or misconfigured service rather than weak credentials; complexity only resists brute-force and guessing attacks. It is tempting because password policies are a standard hardening control, and would be the right answer where the exhibit showed successful credential brute-forcing or password spraying.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which control deficiency is most critical for the IS auditor to address?
hard- A.SSH is configured to allow root login
- B.The admin user logged in successfully with a password
- C.Public key authentication is not being used
- ✓ D.The system lacks a policy to lock accounts after repeated failed login attempts
Why D: The most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.