LPIC-2 System Security Practice Question
A small business has a single Linux server that serves as both a file server (Samba) and a web server (Apache). The server is directly connected to the internet. Recently, there have been numerous brute-force SSH login attempts. The administrator wants to implement a simple solution to block IP addresses that have more than 5 failed SSH attempts in 10 minutes. The server runs Ubuntu 20.04. Which tool should the administrator use to achieve this with minimal configuration?
⚠ Common exam trap
It's easy for candidates to choose UFW (Option A) because it is a common firewall tool, but they overlook that UFW alone cannot dynamically detect and respond to failed login attempts without additional scripting or integration with Fail2ban.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install and configure Fail2ban to monitor /var/log/auth.log.
Fail2ban is the correct tool because it is specifically designed to monitor log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically update firewall rules (via iptables or nftables) to block offending IP addresses. It requires minimal configuration: a default SSH jail is provided out-of-the-box, and the administrator only needs to adjust the `maxretry` and `findtime` parameters to match the requirement of 5 failures in 10 minutes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable UFW and set default deny incoming, allow SSH from specific IPs.
Why it's wrong here
UFW does not automatically block based on failed logins.
- ✓
Install and configure Fail2ban to monitor /var/log/auth.log.
Why this is correct
Fail2ban can ban IPs after a configurable number of failed attempts.
- ✗
Set up TCP wrappers with /etc/hosts.deny for SSH.
Why it's wrong here
TCP wrappers only allow/deny based on addresses, not dynamic failure count.
- ✗
Use port knocking to hide SSH port until a specific sequence is sent.
Why it's wrong here
Port knocking is a different security measure, not a solution for brute-force blocking.
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.