The correct immediate action is to disable root login via SSH. This directly eliminates the ability to authenticate as the root user over SSH, which is a fundamental security best practice per CISSP and industry standards like CIS benchmarks. When a log entry shows repeated failed SSH authentication attempts as root from an internal IP, it signals an active brute-force attack targeting a known privileged account. Disabling root login forces an attacker to guess both a valid username and password, significantly reducing risk. On the CISSP exam, this scenario tests your understanding of access control principles and the principle of least privilege, often appearing in questions about hardening authentication servers. A common trap is to recommend blocking the IP address, but that is a temporary fix; the attacker can simply spoof a new IP. The permanent solution is to eliminate the root account as an SSH target. Memory tip: "Root over SSH is a risk—disable it, don't just dismiss it."
CISSP Security Operations Practice Question
This CISSP practice question tests your understanding of security operations. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
Exhibit:
May 15 09:15:00 authsrvr sshd[1234]: Failed password for root from 10.0.0.5 port 22 ssh2
Based on the log entry from an authentication server, which immediate action should the security team take to reduce risk?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable root login via SSH.
The log entry shows repeated failed SSH authentication attempts as root from an internal IP (10.0.0.5). Disabling root login via SSH (Option C) directly eliminates the ability to authenticate as the root user over SSH, which is a fundamental security best practice per CISSP and industry standards (e.g., CIS benchmarks). This reduces the risk of brute-force attacks targeting the root account, as an attacker would need to guess both a valid username and password instead of targeting a known privileged account.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Block the source IP 10.0.0.5 in the firewall.
Why it's wrong here
May be useful but the IP may be spoofed or not persistent; immediate risk reduction is best via configuration change.
✗
Change the SSH port to a non-standard port.
Why it's wrong here
Security by obscurity; not a robust control.
✓
Disable root login via SSH.
Why this is correct
Eliminates possibility of direct root brute force.
Related concept
Read the scenario before looking for a memorised answer.
✗
Increase the logging verbosity for SSH.
Why it's wrong here
Does not prevent attacks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between reactive controls (blocking an IP) and preventive controls (disabling root login), leading candidates to choose the immediate but less effective action of blocking the source IP instead of addressing the systemic vulnerability.
Detailed technical explanation
How to think about this question
SSH configuration directive `PermitRootLogin` in `/etc/ssh/sshd_config` controls whether root can log in directly. Setting it to `no` forces users to authenticate as a regular user and then use `su` or `sudo` for privilege escalation, which provides an audit trail and reduces the attack surface. In practice, even with strong passwords, root brute-force attempts can consume server resources and trigger alerts; disabling root login is a low-effort, high-impact hardening step recommended by the CIS Benchmarks for Linux and the DISA STIG.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Disable root login via SSH. — The log entry shows repeated failed SSH authentication attempts as root from an internal IP (10.0.0.5). Disabling root login via SSH (Option C) directly eliminates the ability to authenticate as the root user over SSH, which is a fundamental security best practice per CISSP and industry standards (e.g., CIS benchmarks). This reduces the risk of brute-force attacks targeting the root account, as an attacker would need to guess both a valid username and password instead of targeting a known privileged account.
What should I do if I get this CISSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.