An organization's network security administrator has been using an SSH connection to manage switches and routers for several years. After attempting to connect to a router, an alert appears on the…

Question

Options

• AThe SSH keys were given to another department.
• BA MITM attack is being performed by an APT.
• CThe terminal emulator does not support SHA-256.
• DAn incorrect username or password was entered.
• EA key rotation has occurred as a result of an incident.
• FThe workstation is not syncing with the correct NTP server.

• A
  7% (2)
• B
  79% (22)
• D
  11% (3)
• F
  4% (1)

Explanation

SSH stores the host's public key fingerprint locally after the first connection. If the key changes on subsequent connections, the client displays a warning because this is a security-critical event. There are two plausible explanations here. First, a Man-in-the-Middle (MITM) attack (B): an Advanced Persistent Threat actor could have inserted themselves between the administrator's workstation and the router, presenting their own key to intercept the session - this is exactly the attack SSH host key verification is designed to detect. Second, key rotation following an incident (E): if a security incident occurred and the router's SSH keys were regenerated as part of incident response or remediation, the fingerprint would change legitimately. Sharing keys with another department (A) does not cause the host key to change. An incorrect username/password (D) produces an authentication error, not a key change warning. Terminal emulator SHA-256 support (C) would affect cipher negotiation, not trigger a key-changed warning. NTP desync (F) does not affect SSH host key fingerprints.

No community discussion yet for this question.