Preventing SSH Brute Force: Account Lockout
Exhibit
Refer to the exhibit. syslog output: Mar 15 10:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:46 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:47 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:48 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2 Mar 15 10:23:49 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Based on the exhibit, which control is most likely missing to prevent this type of event?
Quick Answer
The answer is implementing account lockout after three failed attempts. This control directly prevents SSH brute force attacks by halting further login attempts once a threshold is exceeded, effectively stopping the attacker regardless of password strength or system patching. On the CISA exam, this scenario tests your understanding of preventive controls versus detective or corrective measures—a common trap is choosing stronger passwords or disabling SSH, but account lockout is the specific, proactive barrier that blocks the brute force method itself. Remember, the key distinction is that lockout stops the attack in progress, while other options only reduce its impact or detect it after the fact. A useful memory tip: “Three strikes and you’re out” directly maps to the three-failed-attempt lockout threshold.
⚠ Common exam trap
A common mix-up: candidates choose 'Disabling direct root login via SSH' (Option C) because it is a well-known security best practice, but it does not prevent brute-force attacks against other user accounts, whereas account lockout directly stops the attack mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing account lockout after three failed attempts
The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Applying the latest security patches to the SSH service
Why it's wrong here
Patching addresses vulnerabilities, not brute-force attacks.
- ✓
Implementing account lockout after three failed attempts
Why this is correct
Account lockout directly mitigates brute-force attacks by blocking further attempts.
- ✗
Disabling direct root login via SSH
Why it's wrong here
Even if root login is disabled, attackers could still brute-force other user accounts.
- ✗
Enforcing strong password complexity
Why it's wrong here
Strong passwords make brute force harder but do not prevent repeated attempts.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which control deficiency is most critical for the IS auditor to address?
hard- A.SSH is configured to allow root login
- B.The admin user logged in successfully with a password
- C.Public key authentication is not being used
- ✓ D.The system lacks a policy to lock accounts after repeated failed login attempts
Why D: The most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.