A security administrator is shown the following log excerpt from a Unix system: 2013 Oct 10 07:14:57 web14 sshd[1632]: Failed password for root from 198.51.100.23 port 37914 ssh2 2013 Oct 10…

Question

Options

• AAn authorized administrator has logged into the root account remotely.
• BThe administrator should disable remote root logins.
• CIsolate the system immediately and begin forensic analysis on the host.
• DA remote attacker has compromised the root account using a buffer overflow in sshd.
• EA remote attacker has guessed the root password using a dictionary attack.
• FUse iptables to immediately DROP connections from the IP 198.51.100.23.
• GA remote attacker has compromised the private key of the root account.
• HChange the root password immediately to a password not found in a dictionary.

• A
  5% (2)
• C
  59% (24)
• D
  2% (1)
• F
  10% (4)
• G
  2% (1)
• H
  22% (9)

Explanation

The log shows five failed password attempts for root from a single IP address in rapid succession, immediately followed by a successful login. This pattern is characteristic of a dictionary or brute-force password attack (E) - an automated tool cycling through common or dictionary passwords until one succeeds. It is not a buffer overflow (D), which would not appear in the authentication log this way, nor a private key compromise (G), which would not involve password failures. Since root has been successfully compromised, the immediate best response is to isolate the system and begin forensic analysis (C) to determine what the attacker did, what was exfiltrated, and whether persistence was established. Simply changing the password (H) or blocking the IP (F) are insufficient responses to an already-confirmed root compromise.

No community discussion yet for this question.