LFCS Operation of Running Systems Practice Question

Network Topology

Refer to the exhibit. What is the most likely security issue?

⚠ Common exam trap

The trap here is that candidates may see 'SSH' and 'root' and incorrectly assume the service is down or the account is disabled, rather than recognizing the pattern of repeated failed login attempts as a brute-force attack.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Someone is attempting to brute-force the root password.

The exhibit shows multiple failed SSH login attempts for the root user from the same IP address in quick succession, as seen in the auth.log or secure log entries. This pattern indicates a brute-force attack, where an attacker systematically tries different passwords to gain unauthorized root access. Option C is correct because the repeated 'Failed password for root' messages are the hallmark of a brute-force attempt.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SSH service is not running.
Why it's wrong here
If sshd were stopped, the port would be closed and connection attempts refused immediately, which contradicts the exhibit's symptom. It tempts because a stopped service is the classic cause of unreachable SSH, and checking systemctl status sshd is the correct step when no process is listening.
✗
The root account is disabled.
Why it's wrong here
A disabled root account is a deliberate hardening measure, not a security issue, so the exhibit cannot show it as the fault. It tempts candidates who equate any root restriction with misconfiguration, but disabling direct root login is exactly what you would configure on a hardened host.
✓
Someone is attempting to brute-force the root password.
Why this is correct
Repeated failed root logins from a single source in the authentication log indicate a brute-force attempt against the root account. The pattern of many rapid failures, rather than a single error, distinguishes deliberate password guessing from ordinary mistyped credentials.
✗
The firewall is blocking SSH.
Why it's wrong here
Firewall rules blocking SSH would produce connection timeouts or refusals, yet the exhibit's evidence points elsewhere. It tempts because firewalls are a common cause of unreachable services, and blocking inbound port 22 is the right diagnosis when packets are dropped before reaching sshd.

Go deeper

LFCS Operation of Running Systems Practice Question

Why each option matters

Option-by-option breakdown

Related to this question