Courseiva
mediumMultiple ChoiceObjective-mapped

ISC2 CC A security analyst observes these SSH logs Practice Question

Exhibit

Refer to the exhibit.
---
$ cat /var/log/syslog | grep "sshd"
Apr 10 03:22:15 server1 sshd[12345]: Failed password for root from 10.0.0.99 port 22 ssh2
Apr 10 03:22:17 server1 sshd[12346]: Failed password for root from 10.0.0.99 port 22 ssh2
Apr 10 03:22:19 server1 sshd[12347]: Failed password for admin from 10.0.0.99 port 22 ssh2
Apr 10 03:22:21 server1 sshd[12348]: Failed password for admin from 10.0.0.99 port 22 ssh2
---

A security analyst observes these SSH logs. What is the MOST likely attack?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Brute force attack on SSH service

Repeated failed login attempts from the same IP indicate a brute force attack on the SSH service. Option B is incorrect because session hijacking involves taking over an existing authenticated session, not repeated login attempts. Option C is incorrect because phishing is a social engineering attack, not evident in these logs. Option D is incorrect because a denial of service attack would typically show a flood of traffic, not repeated authentication attempts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Brute force attack on SSH service

    Why this is correct

    Multiple failed attempts from a single IP.

  • Session hijacking via SSH

    Why it's wrong here

    Session hijacking would not produce failed password logs.

  • Phishing attack targeting root and admin accounts

    Why it's wrong here

    Phishing would not appear in SSH logs.

  • Denial of service attack on port 22

    Why it's wrong here

    DoS would flood connections, not just failed logins.

About these practice questions

Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.