Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst is reviewing authentication logs from a Linux server (`/var/log/auth.log`) after a SIEM alert fired:

May 12 14:02:11 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49152 ssh2
May 12 14:02:14 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49154 ssh2
May 12 14:02:17 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49156 ssh2
May 12 14:02:22 auth-srv sshd[4102]: Accepted password for root from 192.0.2.45 port 49160 ssh2
May 12 14:02:23 auth-srv pam_unix(sshd:session): session opened for user root by (uid=0)

Based on the log snippet above, which of the following statements regarding the incident and appropriate response actions are correct? (Select TWO.)

  1. The event sequence demonstrates a successful password brute-force attack resulting in account compromise.Answer
  2. The affected host should be immediately isolated from the network as part of incident containment.Answer
  3. C
    The log entries indicate a Cross-Site Scripting (XSS) injection attack against the SSH daemon service.
  4. D
    The 'session opened' entry confirms that role-based authorization was evaluated before identity verification took place.

Answer

The correct conclusions are that the event sequence demonstrates a successful password brute-force attack resulting in account compromise, and the affected host should be immediately isolated from the network as part of incident containment.
The sequence of multiple failed password attempts from IP 192.0.2.45 followed immediately by a successful login for the root user indicates a successful brute-force attack. Because privileged access (root) was established by an untrusted source, the immediate incident response action is system containment via network isolation.

Step-by-Step Solution

1
Analyze the log entries chronologically to determine the pattern of activity.
Three consecutive failed password attempts for user 'root' from source IP 192.0.2.45 occur within seconds, followed directly by an 'Accepted password' entry from the same IP.
Rapid consecutive authentication failures followed by success indicate automated credential guessing (brute-force attack).
2
Determine the impact of the successful authentication entry.
The root session was opened (`session opened for user root`), confirming unauthorized administrative access.
Root access gives full privilege on a Linux system, making containment an urgent priority.
3
Identify the immediate incident response containment action.
Isolate the compromised system from the local network.
Host network isolation prevents the attacker from escalating privileges laterally across the network.

Key Concept

Identifying brute-force authentication indicators in log files and determining immediate incident containment steps.
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic