easyMultiple ChoiceObjective-mapped
CRISC Practice Question: Based on the exhibit, which of the following is…
Exhibit
Refer to the exhibit. syslog output: ``` Jan 15 14:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2 Jan 15 14:23:50 server01 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2 Jan 15 14:23:55 server01 sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2 ```
Based on the exhibit, which of the following is the MOST likely risk scenario?
⚠ Common exam trap
Many exam-takers confuse authentication failure logs with network-level attacks (DoS or firewall misconfiguration) or assume that any failed login implies a successful breach, when in fact the logs only show the attempt, not the outcome.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A brute-force attack targeting the root account
The exhibit shows repeated failed login attempts for the root account, which is a classic indicator of a brute-force attack. SSH logs typically record authentication failures, and a high frequency of 'Failed password for root' entries from a single source IP strongly suggests an automated password guessing attempt. This aligns with the risk scenario of a brute-force attack targeting the root account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A denial-of-service attack on the SSH service
Why it's wrong here
Failed attempts are not DoS; DoS would overwhelm the service.
- ✓
A brute-force attack targeting the root account
Why this is correct
Multiple failed password attempts in quick succession suggest a brute-force attack.
- ✗
A successful privilege escalation by an insider
Why it's wrong here
No indication of success or insider activity.
- ✗
A misconfigured firewall allowing unauthorized access
Why it's wrong here
Firewall misconfiguration is not directly indicated; the attack is via SSH.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.