Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst is reviewing Linux authentication log entries forwarded to a SIEM aggregator from host server1:

Jul 27 14:10:01 server1 sshd[1042]: Failed password for root from 198.51.100.45 port 49210 ssh2
Jul 27 14:10:03 server1 sshd[1044]: Failed password for root from 198.51.100.45 port 49212 ssh2
Jul 27 14:10:05 server1 sshd[1046]: Failed password for root from 198.51.100.45 port 49215 ssh2
Jul 27 14:10:08 server1 sshd[1049]: Accepted password for root from 198.51.100.45 port 49218 ssh2

Based on these log entries, which TWO of the following conclusions can be accurately drawn regarding this security event? (Select TWO)

  1. An SSH brute-force authentication attack was executed from IP address 198.51.100.45.Answer
  2. B
    The log pattern shows a web application SQL injection attack targeting database credentials.
  3. The attacker successfully authenticated and gained system access as the root user.Answer
  4. D
    The log entries record an authorization failure during role-based permission verification.

Answer

The logs demonstrate an SSH brute-force password attack from IP address 198.51.100.45 that ultimately resulted in a successful authentication compromise of the root user.
The sequence of rapid password failures followed by an accepted password entry confirms both an SSH brute-force attempt from IP address 198.51.100.45 and a successful account compromise of the root user.

Step-by-Step Solution

1
Inspect the failure pattern in the SSH service log stream.
Identified three consecutive password failure messages from source IP 198.51.100.45 within a seven-second window targeting root.
Rapid sequential failed login attempts from a single IP address indicate an SSH password brute-force attack.
2
Examine the final log line in the sequence.
Observed 'Accepted password for root from 198.51.100.45'.
An 'Accepted password' entry confirms that the authentication mechanism validated the password, indicating a compromised account.

Key Concept

Log Analysis and SIEM Management
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic