hardMultiple ChoiceObjective-mapped
CCSP Practice Question: An administrator notices the log entries in the…
Exhibit
Refer to the exhibit. ``` Oct 12 09:15:22 cloudhost sshd[1234]: Failed password for admin from 203.0.113.55 port 2213 ssh2 Oct 12 09:15:25 cloudhost sshd[1234]: Accepted password for admin from 203.0.113.55 port 2213 ssh2 Oct 12 09:15:30 cloudhost sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/usr/bin/mysql -h db-internal -u root -pS3cur3P@ss Oct 12 09:16:00 cloudhost mysqld[2345]: 2023-10-12 9:16:00 2 [Note] Access denied for user 'root'@'cloudhost' (using password: YES) ```
An administrator notices the log entries in the exhibit from a cloud-hosted server. What is the MOST likely security concern indicated by these logs?
⚠ Common exam trap
ISC2 often tests the distinction between a successful brute-force attack and data exfiltration, where candidates confuse a successful login with actual data theft, but the logs here only show the password exposure, not data movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A brute-force attack succeeded in logging into the system, and a database password was exposed in the command line
The log entries show a successful SSH login followed by a MySQL command that includes the database password in plaintext on the command line (e.g., `mysql -u root -pPassword123`). This indicates a brute-force attack succeeded, and the password was exposed in the process list or shell history, which is a critical data security concern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A brute-force attack succeeded in logging into the system, and a database password was exposed in the command line
Why this is correct
Failed then accepted login indicates brute-force success; password in plaintext is a credential exposure.
- ✗
Data was exfiltrated from the MySQL database
Why it's wrong here
No evidence of data exfiltration; access was denied.
- ✗
The MySQL database was accessed by an unauthorized user
Why it's wrong here
The MySQL access was denied, so no successful database access.
- ✗
A failed SSH login attempt indicates a misconfigured firewall
Why it's wrong here
A failed login does not indicate firewall misconfiguration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.