SSCP Systems and Application Security Practice Question
A security analyst is reviewing Linux audit logs with auditd. Which TWO events would be of greatest concern for a server that should not have interactive logins? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Successful root login via SSH
Failed login attempts indicate brute force; successful root login indicates unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Successful root login via SSH
Why this is correct
Unauthorized interactive login.
- ✗
System reboot logs
Why it's wrong here
Reboot may be planned maintenance.
- ✓
Multiple failed su attempts
Why this is correct
Indicates brute force or unauthorized privilege escalation.
- ✗
Successful cron job execution
Why it's wrong here
Cron jobs are normal automated tasks.
- ✗
File permission changes by a non-root user
Why it's wrong here
May be legitimate if allowed by sudo.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.