mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
Mar 15 10:30:22 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:30:27 server sshd[1235]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:30:32 server sshd[1236]: Failed password for root from 192.168.1.100 port 22 ssh2 Mar 15 10:30:37 server sshd[1237]: Failed password for root from 192.168.1.100 port 22 ssh2
Refer to the exhibit. A security analyst sees these logs from a Linux server. Which security control should the analyst recommend to address this pattern?
⚠ Common exam trap
ISC2 often tests the distinction between reactive controls (like blocking an IP or locking an account) and proactive controls (like 2FA) that address the root cause of authentication attacks, leading candidates to pick a quick fix like IP blocking instead of the more robust security measure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement two-factor authentication for SSH access.
The logs show repeated failed SSH login attempts from a single IP (192.168.1.100) targeting the root account, which is a classic brute-force attack pattern. Two-factor authentication (2FA) for SSH access is the most effective control because it adds a second authentication factor (e.g., TOTP or hardware token) that an attacker cannot bypass even if they guess the password, thus neutralizing the brute-force attack regardless of the number of attempts or the account targeted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable account lockout after 5 failed attempts.
Why it's wrong here
Lockout can mitigate but attackers sometimes slow down to avoid triggering it; not as strong as 2FA.
- ✗
Disable root login via SSH.
Why it's wrong here
Reduces risk but attacker can target other accounts; does not prevent password guessing.
- ✗
Block the IP address 192.168.1.100 via firewall.
Why it's wrong here
Blocks this attacker but others may attack from different IPs; not a comprehensive solution.
- ✓
Implement two-factor authentication for SSH access.
Why this is correct
2FA prevents unauthorized access even if passwords are compromised.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
One-time Password
A one-time password is a temporary, single-use code that authenticates a user for one login session or transaction.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.