hardMultiple ChoiceObjective-mapped
SSCP Practice Question: What does this log entry most likely indicate?
Exhibit
Refer to the exhibit. May 12 14:32:18 server sshd[1234]: Failed password for invalid user admin from 192.168.1.10 port 22 ssh2
What does this log entry most likely indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker is attempting to gain access by guessing usernames
The log shows a failed SSH authentication for an 'invalid user' (i.e., a username that does not exist on the system). This is typical of a brute-force or reconnaissance attack where the attacker tries common usernames. Option C correctly identifies this as an attacker attempting to guess usernames. Option A is incorrect because the log does not indicate misconfiguration. Option B is incorrect because it is not a mistyped password for a valid user; the user does not exist. Option D is incorrect because the user 'admin' does not exist, not just disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSH service is misconfigured
Why it's wrong here
There is no indication of misconfiguration; failed logins for invalid users are common attack patterns.
- ✗
A user mistyped their password
Why it's wrong here
The log specifies 'invalid user', meaning the username does not exist, not a password error for a valid user.
- ✓
An attacker is attempting to gain access by guessing usernames
Why this is correct
The presence of an invalid username suggests reconnaissance or brute-force activity.
- ✗
The user account 'admin' has been disabled
Why it's wrong here
A disabled account would show 'disabled account' or similar, not 'invalid user'.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.