Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing the following syslog sequence captured from a Linux bastion server:

Jul 27 14:15:02 sec-srv01 sshd[18420]: Failed password for invalid user admin from 198.51.100.45 port 42102 ssh2
Jul 27 14:15:05 sec-srv01 sshd[18422]: Failed password for invalid user admin from 198.51.100.45 port 42108 ssh2
Jul 27 14:15:09 sec-srv01 sshd[18425]: Failed password for valid user devops from 198.51.100.45 port 42115 ssh2
Jul 27 14:15:14 sec-srv01 sshd[18429]: Accepted publickey for devops from 198.51.100.45 port 42122 ssh2 RSA SHA256:7b+x...

Based on these log entries, which of the following events has occurred?

  1. An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.Answer
  2. B
    The devops account successfully authenticated via public key and was automatically granted elevated administrative authorization on the local operating system.
  3. C
    The server blocked a SQL injection authentication bypass attack targeted against the local user database.
  4. D
    The log sequence represents a continuous network drop by the perimeter firewall due to invalid port assignments.

Answer

An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.
The log sequence demonstrates an initial set of failed password authentication attempts from IP address 198.51.100.45 targeting invalid accounts ('admin') and a valid account ('devops'). The final entry shows a successful logon for the user 'devops' using an SSH RSA public key from the same source IP.

Step-by-Step Solution

1
Analyze the log entries sequentially by timestamp and event message.
Entries show repeated failed password attempts from IP 198.51.100.45 for both non-existent ('admin') and existing ('devops') accounts.
Tracking account names and failure statuses identifies initial password guessing or account scanning behavior.
2
Evaluate the final log entry in the sequence.
The final entry records 'Accepted publickey for devops' from the same IP address.
This confirms successful identity verification using SSH key authentication following the failed password attempts.

Key Concept

SSH Authentication Telemetry and Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic