Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

A security analyst is investigating a alert on an internal Linux server and reviews the following authentication log entries:

text
Jul 27 14:10:02 auth-server sshd[4102]: Failed password for root from 203.0.113.5 port 49152 ssh2
Jul 27 14:10:03 auth-server sshd[4105]: Failed password for root from 203.0.113.5 port 49154 ssh2
Jul 27 14:10:04 auth-server sshd[4109]: Failed password for root from 203.0.113.5 port 49156 ssh2
Jul 27 14:10:05 auth-server sshd[4112]: Failed password for root from 203.0.113.5 port 49158 ssh2

Which type of security event is directly indicated by these log entries?

  1. A
    A Cross-Site Scripting (XSS) payload execution against a web interface
  2. An SSH password brute-force attack against the root user accountCevap
  3. C
    An authorization permission failure when accessing protected files
  4. D
    A corrective security control automatically blocking database queries

Cevap

An SSH password brute-force attack against the root user account
The correct answer is correct because the SSH log entries (`sshd`) show repeated, consecutive `Failed password` messages for the privileged `root` user originating from the same source IP (`203.0.113.5`) in one-second intervals, which is a classic signature of an automated brute-force login attack.

Adım Adım Çözüm

1
Examine the log service process and message type.
The process `sshd` indicates Secure Shell daemon logs reporting `Failed password` for the user `root`.
Identifying the daemon and status clarifies that authentication attempts are failing.
2
Analyze timestamps and source address pattern.
Consecutive login failures occur every second from IP `203.0.113.5`.
Rapid, automated repeat attempts from a single source address confirm an automated password brute-force pattern.

Anahtar Kavram

SSH Authentication Log Analysis
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru