mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security analyst observes the log entries on an…
Exhibit
Refer to the exhibit. ``` Aug 12 14:23:45 server sshd[12345]: Failed password for root from 10.0.0.99 port 54321 ssh2 Aug 12 14:23:46 server sshd[12345]: Failed password for root from 10.0.0.99 port 54321 ssh2 Aug 12 14:23:47 server sshd[12345]: Failed password for root from 10.0.0.99 port 54321 ssh2 Aug 12 14:23:48 server sshd[12345]: Failed password for root from 10.0.0.99 port 54321 ssh2 ```
A security analyst observes the log entries on an SSH server as shown. What is the most likely type of attack in progress?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute-force attack
The log shows repeated failed password attempts for the root account from the same IP address in rapid succession. This pattern is characteristic of a brute-force attack, where an attacker tries many passwords systematically to gain access. Option C is therefore correct. Dictionary attack (A) is a subtype but the log does not indicate use of a dictionary list specifically; brute-force is the broader, correct classification. Privilege escalation (B) typically involves exploiting vulnerabilities after gaining initial access, not repeated login attempts. Denial-of-service (D) would involve overwhelming the service, not attempting authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dictionary attack
Why it's wrong here
A dictionary attack also uses multiple passwords, but the log does not specify whether passwords are from a dictionary; brute-force is a broader term.
- ✗
Privilege escalation
Why it's wrong here
Privilege escalation would occur after gaining access, not during login attempts.
- ✓
Brute-force attack
Why this is correct
Multiple rapid failures from the same IP indicate an automated brute-force attempt to guess the password.
- ✗
Denial-of-service (DoS) attack
Why it's wrong here
A DoS aims to overload the service, not to gain access.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.