mediumMultiple Choice

SSCP Practice Question: Based on the exhibit, which security threat is…

Exhibit

Refer to the exhibit.

May 15 10:23:45 server1 sshd[12345]: Failed password for root from 192.168.1.100 port 22 ssh2
May 15 10:23:46 server1 sshd[12345]: Failed password for root from 192.168.1.100 port 22 ssh2
May 15 10:23:47 server1 sshd[12345]: Failed password for root from 192.168.1.100 port 22 ssh2
... (multiple entries within seconds)

Based on the exhibit, which security threat is likely being attempted?

⚠ Common exam trap

ISC2 often tests the distinction between brute-force attacks and other threats by embedding subtle clues like 'multiple failed logins' in logs, which candidates may misinterpret as a man-in-the-middle attack due to the presence of authentication errors, but the key is the volume and repetition of failures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute-force attack

The exhibit shows a large number of failed login attempts (e.g., 'Login failed' or 'Authentication error') from a single source IP within a short time window, which is the classic signature of a brute-force attack. This attack systematically tries multiple username/password combinations to gain unauthorized access, and the repeated failure messages in the logs confirm the attempt.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts resolver cache entries so name lookups return attacker-controlled addresses, typically shown as altered A records or spoofed responses. It is tempting because it also redirects traffic, but the exhibit's evidence does not centre on name-resolution records.
✗
Man-in-the-middle attack
Why it's wrong here
A man-in-the-middle attack intercepts traffic between two parties, evidenced by ARP spoofing, rogue proxies or duplicated session credentials. It is tempting because it also involves credential or data capture, but the exhibit does not show interception between endpoints.
✓
Brute-force attack
Why this is correct
Repeated authentication attempts against one account, as shown in the exhibit, indicate a brute-force attack: systematic credential guessing rather than exploitation of a software flaw. This matches the stem's exhibited pattern of many failed logons from a single source.
✗
SQL injection
Why it's wrong here
SQL injection inserts database syntax through unsanitised input fields, evidenced by query strings containing UNION, quotes or tautologies. It is tempting because it also targets web applications, yet the exhibit shows no database query manipulation, so this mechanism is absent.

Go deeper

SSCP Practice Question: Based on the exhibit, which security threat is…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question