mediumMultiple ChoiceObjective-mapped
CISSP A security analyst at a financial institution Practice Question
You are a security analyst at a financial institution. The company has a hybrid infrastructure with on-premises servers and AWS cloud. The on-premises network uses a SIEM that aggregates logs from all sources. Recently, the SIEM has been generating a high volume of alerts for failed SSH login attempts from an internal IP (10.10.50.100) to multiple Linux servers. The IP belongs to a jump box used by system administrators. Upon investigation, you find that the jump box is running a hardened OS, and only authorized admins can access it via SSH key authentication. However, the failed login attempts show usernames like 'root', 'admin', 'test', which are not valid accounts on the target servers. The attempts occur every 5 seconds around the clock. There are no successful logins from that IP. The jump box has the latest patches and antivirus. What should you do FIRST?
⚠ Common exam trap
The trap here is that candidates focus on the 'hardened OS' and 'no successful logins' as signs of safety, but CISSP expects you to recognize that anomalous outbound attack traffic from an internal asset is a containment trigger, not a false positive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the jump box from the network immediately and conduct a forensic analysis
The jump box is exhibiting automated, high-frequency failed login attempts with non-existent usernames, which is a classic indicator of a compromised host being used as an attack launch point—even if the OS appears hardened and AV shows clean. The first priority in incident response is containment; isolating the jump box prevents further potential lateral movement or data exfiltration while preserving forensic evidence. A forensic analysis is then required to determine the root cause (e.g., a hidden backdoor, credential theft, or kernel-level rootkit) before any remediation steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the usernames 'root', 'admin', 'test' to the target servers' password blacklist
Why it's wrong here
Adding specific usernames to a blacklist on target servers is a reactive and incomplete measure. This action fails to address the potential compromise of the jump box itself, which is the source of the suspicious activity. An attacker could easily pivot to other common or custom usernames, rendering this partial defense ineffective against a persistent brute-force or credential-stuffing attack originating from a potentially compromised system.
- ✓
Isolate the jump box from the network immediately and conduct a forensic analysis
Why this is correct
Immediately isolating the jump box is the critical first step in incident response, serving as a primary containment strategy to halt any ongoing malicious activity and prevent lateral movement within the network. Following isolation, conducting a thorough forensic analysis is essential to determine the attack vector, identify indicators of compromise (IOCs), assess the scope of the breach, and gather evidence for eradication and recovery efforts. This comprehensive approach prioritizes stopping the threat and understanding its nature.
- ✗
Ignore the alerts because the usernames are invalid and the jump box is hardened
Why it's wrong here
Ignoring these alerts, even if initial attempts use invalid usernames or target a hardened system, is a grave security misstep. Persistent brute-force or credential-stuffing attacks can eventually succeed by finding a valid credential or exploiting a vulnerability, regardless of initial system hardening. This complacency violates fundamental security principles, leaving the organization vulnerable to a successful breach, data exfiltration, or further system compromise.
- ✗
Run a full antivirus scan on the jump box and check for malware
Why it's wrong here
While running an antivirus scan is a valid step in the incident response lifecycle, it is not the immediate priority when suspicious activity is detected from a critical asset like a jump box. Containment, specifically isolating the suspected compromised system, must precede scanning to prevent further damage or lateral movement by an active attacker. A scan on an active, compromised system could also alert the attacker, allowing them to evade detection or escalate their attack before proper containment is achieved.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.