CISM Information Security Risk Management Practice Question
Exhibit
Refer to the exhibit. Exhibit: ``` Log Entry: Jan 15 09:23:45 server1 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2 Jan 15 09:23:47 server1 sshd[1235]: Failed password for admin from 10.0.0.5 port 22 ssh2 Jan 15 09:23:50 server1 sshd[1236]: Failed password for root from 10.0.0.5 port 22 ssh2 Jan 15 09:23:52 server1 sshd[1237]: Failed password for admin from 10.0.0.5 port 22 ssh2 ```
Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?
⚠ Common exam trap
Many exam-takers confuse preventive controls (password policy) with detective controls (logging) or overcorrect with risk avoidance (disabling SSH), instead of recognizing that a targeted brute-force attack is best addressed with a specific technical control like account lockout that directly blocks the attack pattern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement account lockout after 3 failed attempts.
Implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the password policy to require 12-character passwords.
Why it's wrong here
Strong passwords help but do not prevent repeated attempts.
- ✗
Increase logging verbosity to capture more details.
Why it's wrong here
More logging does not mitigate the attack.
- ✗
Disable SSH access and use console only.
Why it's wrong here
Overly restrictive, impacting productivity.
- ✓
Implement account lockout after 3 failed attempts.
Why this is correct
This control directly mitigates brute-force attacks by locking accounts.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.