Courseiva
← SSCP
Full test
hardMultiple ChoiceObjective-mapped

Identifying and Responding to Brute Force Attacks in SSH Logs

Exhibit

Refer to the exhibit.
[Linux auth.log]
Feb 18 10:15:22 server sshd[1234]: Failed password for root from 203.0.113.5 port 22 ssh2
Feb 18 10:15:23 server sshd[1234]: Failed password for root from 203.0.113.5 port 22 ssh2
... (50 more identical lines)
Feb 18 10:15:25 server sshd[1234]: Accepted password for root from 203.0.113.5 port 22 ssh2

Refer to the exhibit. An analyst reviews the sshd log. What should be the immediate response?

Quick Answer

The immediate response is to change the root password and disable root SSH login. This is correct because the sshd log reveals repeated failed root login attempts from a single IP address, which is the classic signature of a brute force attack detection logs pattern targeting the root account. By changing the password and setting `PermitRootLogin no` in the SSH configuration, you directly eliminate the attack vector—no amount of password guessing can succeed if root cannot authenticate via SSH at all. On the Systems Security Certified Practitioner SSCP exam, this scenario tests your ability to apply the principle of least privilege and incident response prioritization; a common trap is to focus on blocking the IP address first, but the root account itself remains vulnerable to future attacks from other sources. Remember the mnemonic "Root Lock First"—always neutralize the targeted account before chasing the attacker.

⚠ Common exam trap

It's easy for candidates to choose to block the source IP (Option A) because it seems like a quick fix, but they overlook that the root account remains exposed and the attacker can simply switch IPs, making the password change and disabling root login the correct immediate response.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the root password and disable root SSH login

The sshd log shows repeated failed root login attempts from IP 203.0.113.5, indicating a brute-force attack targeting the root account. The immediate response is to change the root password and disable root SSH login (e.g., set `PermitRootLogin no` in `/etc/ssh/sshd_config`), as this directly mitigates the attack vector by removing the ability to authenticate as root via SSH. This aligns with the principle of least privilege and is a standard first step in SSH security hardening.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Block the source IP 203.0.113.5 on the firewall

    Why it's wrong here

    Blocking IP is a good step but does not address the compromised root account.

  • ✗

    Disable SSH service on the server

    Why it's wrong here

    Disabling SSH may break legitimate administration.

  • ✗

    Inform the server administrator of the suspicious activity

    Why it's wrong here

    Informing is not an immediate containment action.

  • ✓

    Change the root password and disable root SSH login

    Why this is correct

    Immediately revoke access for the compromised account and prevent further use.

About these practice questions

One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on SSCP

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Based on the exhibit, which type of attack is most likely occurring?

easy
  • A.Denial of service.
  • ✓ B.Brute force attack.
  • C.Dictionary attack.
  • D.Man-in-the-middle.

Why B: The exhibit shows a high number of failed authentication attempts (e.g., 1000+ failures) from a single source IP within a short time window, targeting a specific user account. This pattern is characteristic of a brute force attack, where an attacker systematically tries many password combinations to gain unauthorized access. Unlike a dictionary attack, which uses a predefined list of likely passwords, a brute force attack exhaustively tests all possible combinations, as indicated by the sheer volume of attempts.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.