Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

An IT auditor inspects syslog entries forwarded to an enterprise SIEM aggregator from a Linux server. The log stream records the following sequential events:

`2026-07-27T14:15:02Z host1 sshd[4821]: Failed password for invalid user root from 198.51.100.45 port 42102 ssh2`
`2026-07-27T14:15:03Z host1 sshd[4825]: Failed password for invalid user admin from 198.51.100.45 port 42104 ssh2`
`2026-07-27T14:15:04Z host1 sshd[4830]: Failed password for invalid user service from 198.51.100.45 port 42108 ssh2`

Which malicious activity is most directly demonstrated by these log entries?

  1. A brute-force authentication attack targeting system account namesCevap
  2. B
    An authorization control failure allowing access permissions misuse
  3. C
    A SIEM correlation engine parsing fault misordering event timestamps
  4. D
    A detective control acting as a preventive firewall rule

Cevap

A brute-force authentication attack targeting system account names
The correct option correctly identifies the signature of an automated brute-force login attack. The syslog output captures sequential authentication failures from a single remote host testing multiple standard user accounts in rapid succession.

Adım Adım Çözüm

1
Analyze the log source and process daemon
The entries come from sshd handling Secure Shell login requests
Identifies the core service receiving inbound traffic
2
Examine patterns in timestamps, source IPs, and status messages
Multiple failed attempts occur within seconds from IP 198.51.100.45 trying common administrative usernames
Rapid successive failures for different accounts from one origin indicate password guessing or brute-force scanning

Anahtar Kavram

Log Analysis and SIEM Management
Tahmini Süre:45s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru