CAS-003 · Question #170
CAS-003 Question #170: Real Exam Question with Answer & Explanation
The correct answer is C: Isolate the system immediately and begin forensic analysis on the host.. The log shows six attempts to log in to a system. The first five attempts failed due to `failed password'. The sixth attempt was a successful login. Therefore, the MOST likely explanation of what is occurring is that a remote attacker has guessed the root password using a diction
Question
Options
- AAn authorized administrator has logged into the root account remotely.
- BThe administrator should disable remote root logins.
- CIsolate the system immediately and begin forensic analysis on the host.
- DA remote attacker has compromised the root account using a buffer overflow in sshd.
- EA remote attacker has guessed the root password using a dictionary attack.
- FUse iptables to immediately DROP connections from the IP 198.51.100.23.
- GA remote attacker has compromised the private key of the root account.
- HChange the root password immediately to a password not found in a dictionary.
Explanation
The log shows six attempts to log in to a system. The first five attempts failed due to `failed password'. The sixth attempt was a successful login. Therefore, the MOST likely explanation of what is occurring is that a remote attacker has guessed the root password using a dictionary The BEST immediate response is to isolate the system immediately and begin forensic analysis on the host. You should isolate the system to prevent any further access to it and prevent it from doing any damage to other systems on the network. You should perform a forensic analysis on the system to determine what the attacker did on the system after gaining access.
Community Discussion
No community discussion yet for this question.