LPIC-2 System Security Practice Question
A company runs an Apache web server (port 80) and an SSH server (port 22) for remote administration. The system administrator notices that the server has become sluggish and network traffic has increased significantly. Checking /var/log/auth.log reveals hundreds of failed SSH authentication attempts per minute from diverse IP addresses targeting the 'admin' user. The administrator wants to mitigate this brute-force attack with minimal impact on legitimate users. Which course of action is most effective?
⚠ Common exam trap
Watch out — candidates often choose Option A (changing the SSH port) as a quick fix, mistaking obscurity for effective security, or Option B (disabling password auth) as a permanent solution, without recognizing that the immediate goal is to stop the ongoing attack with minimal disruption, which fail2ban achieves through automated, dynamic blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install and configure fail2ban to block IP addresses after 5 failed SSH attempts within 10 minutes.
Fail2ban is specifically designed to mitigate brute-force attacks by monitoring log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically updating firewall rules (e.g., iptables or nftables) to block offending IP addresses. This approach is automated, reduces manual intervention, and has minimal impact on legitimate users since only IPs exceeding the threshold are blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the SSH port to a non-standard port number.
Why it's wrong here
Security by obscurity is ineffective; attackers scan all ports, and this does not prevent brute-force on the new port.
- ✗
Disable password authentication for SSH and use key-based authentication only.
Why it's wrong here
While more secure long-term, this does not immediately mitigate the ongoing attack and may lock out users who only have password access.
- ✗
Add the offending IP addresses to /etc/hosts.deny manually.
Why it's wrong here
Manual blocking is impractical with hundreds of IPs and does not adapt to new attackers.
- ✓
Install and configure fail2ban to block IP addresses after 5 failed SSH attempts within 10 minutes.
Why this is correct
fail2ban dynamically blocks offending IPs, reducing attack surface while allowing legitimate users who might mistype credentials.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.