hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Refer to the exhibit
Exhibit
Jan 15 08:30:00 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2 Jan 15 08:30:05 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2 Jan 15 08:30:10 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2 ... (repeated 50 times in 5 minutes) Jan 15 08:35:00 server sshd[1234]: Connection closed by 192.168.1.100 port 22
Refer to the exhibit. A security analyst reviews the log and determines that the system was under a brute force attack. However, the analyst notices that the attack stopped after 5 minutes, and the IP address was not blocked. Which of the following is the MOST likely reason the attack stopped?
⚠ Common exam trap
Candidates often confuse session-level authentication limits (MaxAuthTries) with persistent account lockout policies or firewall blocks, leading candidates to incorrectly choose account lockout or firewall options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSH server's MaxAuthTries limit was exceeded.
The SSH server's MaxAuthTries limit (default 6 in OpenSSH) causes the server to terminate the connection after a threshold of failed authentication attempts. This stops the attack on that specific TCP session, but does not block the IP address, which explains why the attack ceased after 5 minutes without any persistent block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SSH server's MaxAuthTries limit was exceeded.
Why this is correct
MaxAuthTries causes the connection to close after a set number of failures.
- ✗
The system's account lockout policy prevented further attempts.
Why it's wrong here
Lockout would block the account, but the attacker could still open new connections.
- ✗
The attacker achieved successful login.
Why it's wrong here
No success message appears in the log.
- ✗
The system's firewall dropped the traffic.
Why it's wrong here
Firewall drop would show no connection closed messages.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.