Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

An IT auditor inspects syslog entries forwarded to an enterprise SIEM aggregator from a Linux server. The log stream records the following sequential events:

`2026-07-27T14:15:02Z host1 sshd[4821]: Failed password for invalid user root from 198.51.100.45 port 42102 ssh2`
`2026-07-27T14:15:03Z host1 sshd[4825]: Failed password for invalid user admin from 198.51.100.45 port 42104 ssh2`
`2026-07-27T14:15:04Z host1 sshd[4830]: Failed password for invalid user service from 198.51.100.45 port 42108 ssh2`

Which malicious activity is most directly demonstrated by these log entries?

  1. A brute-force authentication attack targeting system account namesAnswer
  2. B
    An authorization control failure allowing access permissions misuse
  3. C
    A SIEM correlation engine parsing fault misordering event timestamps
  4. D
    A detective control acting as a preventive firewall rule

Answer

A brute-force authentication attack targeting system account names
The correct option correctly identifies the signature of an automated brute-force login attack. The syslog output captures sequential authentication failures from a single remote host testing multiple standard user accounts in rapid succession.

Step-by-Step Solution

1
Analyze the log source and process daemon
The entries come from sshd handling Secure Shell login requests
Identifies the core service receiving inbound traffic
2
Examine patterns in timestamps, source IPs, and status messages
Multiple failed attempts occur within seconds from IP 198.51.100.45 trying common administrative usernames
Rapid successive failures for different accounts from one origin indicate password guessing or brute-force scanning

Key Concept

Log Analysis and SIEM Management
Estimated Time:45s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic