200-201 · Question #306
Refer to the exhibit. Which alert is identified from this packet capture?
The correct answer is B. brute-force attack. The packet capture showing numerous SSH 'Authentication failed' messages from a single source IP to a target server is indicative of a brute-force attack.
Question
Refer to the exhibit. Which alert is identified from this packet capture?
Exhibit
Options
- Aman-in-the-middle attack
- Bbrute-force attack
- CARP poisoning
- DSQL injection
How the community answered
(45 responses)- A2% (1)
- B76% (34)
- C16% (7)
- D7% (3)
Why each option
The packet capture showing numerous SSH 'Authentication failed' messages from a single source IP to a target server is indicative of a brute-force attack.
A man-in-the-middle attack would involve intercepting and potentially altering communications, typically showing altered key exchanges or certificate warnings, not primarily repeated authentication failures.
The exhibit displays multiple SSH connection attempts from IP 10.0.0.1 to 10.0.0.5, consistently resulting in 'Authentication failed' messages, which is the signature behavior of a brute-force attack attempting to guess credentials.
ARP poisoning is a Layer 2 attack involving spoofed MAC-to-IP address mappings on a local network, which is unrelated to SSH authentication failures.
SQL injection is a web application vulnerability targeting databases through malicious input in HTTP/HTTPS requests, not SSH authentication.
Concept tested: Wireshark SSH analysis, brute-force attack detection
Source: https://www.ssh.com/academy/ssh/brute-force
Topics
Community Discussion
No community discussion yet for this question.