mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: Which access control mechanism most likely failed…
Exhibit
Refer to the exhibit. The following is from /var/log/secure on a Linux server: Jan 21 09:15:30 server sshd[1234]: Failed password for invalid user admin from 192.168.1.1 port 22 ssh2 Jan 21 09:15:31 server sshd[1235]: Failed password for invalid user root from 192.168.1.1 port 22 ssh2 ... (multiple similar lines) Jan 21 09:20:01 server su[5678]: pam_unix(su:session): session opened for user root by john(uid=1000) The failed attempts are all from the same IP, and then user 'john' successfully runs `su` to root.
Which access control mechanism most likely failed to prevent this unauthorized privilege escalation?
⚠ Common exam trap
ISC2 often tests the misconception that account lockout policies are a catch-all defense against unauthorized access, when in fact they only prevent brute-force login attempts and do not control actions taken by an already authenticated user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Account lockout policy
An account lockout policy is designed to prevent brute-force attacks by locking an account after a specified number of failed login attempts. In the context of unauthorized privilege escalation, a lockout policy would not prevent a user who already has valid credentials from escalating privileges through other means, such as exploiting a misconfigured sudoers file or a kernel vulnerability. Therefore, the failure of the account lockout policy is the most likely mechanism that allowed the escalation, as it does not control what an authenticated user can do after login.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sudoers configuration
Why it's wrong here
Sudoers controls who can run commands as other users; it would not have prevented the su attempt if the password was guessed.
- ✓
Account lockout policy
Why this is correct
An account lockout policy would have locked the account after a threshold of failed attempts, preventing the eventual successful login.
- ✗
Password policy
Why it's wrong here
Password policy governs complexity and expiration, not the number of attempts.
- ✗
SELinux
Why it's wrong here
SELinux enforces mandatory access controls on processes, not authentication attempt limits.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.