easyMultiple ChoiceObjective-mapped
SSCP Practice Question: Based on the exhibit, which type of attack is…
Exhibit
Refer to the exhibit. Oct 12 14:23:45 server sshd[1234]: Failed password for root from 192.168.1.200 port 22 ssh2 Oct 12 14:23:47 server sshd[1234]: Failed password for root from 192.168.1.200 port 22 ssh2 Oct 12 14:23:49 server sshd[1234]: Failed password for root from 192.168.1.200 port 22 ssh2 Oct 12 14:23:51 server sshd[1234]: Failed password for root from 192.168.1.200 port 22 ssh2
Based on the exhibit, which type of attack is most likely occurring?
⚠ Common exam trap
Candidates often confuse a brute force attack with a dictionary attack, but the key differentiator is the exhaustive, non-selective nature of the attempts versus the use of a precompiled wordlist.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute force attack.
The exhibit shows a high number of failed authentication attempts (e.g., 1000+ failures) from a single source IP within a short time window, targeting a specific user account. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations to gain unauthorized access. Unlike a dictionary attack, which uses a predefined list of likely passwords, a brute force attack exhaustively tests all possible combinations, as indicated by the sheer volume of attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Denial of service.
Why it's wrong here
DoS attacks aim to overwhelm services, not repeatedly authenticate.
- ✓
Brute force attack.
Why this is correct
Multiple rapid failed attempts for the same user from one IP is characteristic of brute force.
- ✗
Dictionary attack.
Why it's wrong here
Dictionary attacks use a wordlist, but the logs do not show patterns of many different passwords; brute force is more general.
- ✗
Man-in-the-middle.
Why it's wrong here
MITM attacks intercept communications; failed SSH logins do not indicate this.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.