CISSP · Question #1490
Which of the following could cause a Denial of Service (DoS) against an authentication system?
The correct answer is D. Remote access audit logs. Audit log mismanagement can inadvertently cause a Denial of Service against an authentication system when logs fill up storage resources. Remote access audit logs are especially high-volume and can exhaust disk space, causing authentication services to fail.
Question
Options
- AEncryption of audit logs
- BNo archiving of audit logs
- CHashing of audit logs
- DRemote access audit logs
How the community answered
(35 responses)- A9% (3)
- B3% (1)
- C3% (1)
- D86% (30)
Why each option
Audit log mismanagement can inadvertently cause a Denial of Service against an authentication system when logs fill up storage resources. Remote access audit logs are especially high-volume and can exhaust disk space, causing authentication services to fail.
Encryption of audit logs affects the confidentiality of log data but does not consume excessive storage or block authentication services from functioning, so it does not cause a DoS.
While failing to archive logs can eventually lead to storage exhaustion, the question asks what 'could cause' a DoS, and the act of not archiving is a contributing condition rather than the direct mechanism that a high-volume source like remote access logs represents.
Hashing of audit logs is an integrity-protection mechanism that adds minimal overhead and does not consume storage in a way that would deny access to the authentication system.
Remote access audit logs generate extremely high volumes of log data because every authentication attempt, session establishment, and access event is recorded. If the storage allocated for these logs becomes full and the system is configured to halt operations when it cannot write audit entries (a common security requirement), the authentication system itself can be rendered unavailable, constituting a DoS condition.
Concept tested: Audit log volume causing authentication system denial of service
Source: https://csrc.nist.gov/publications/detail/sp/800-92/final
Topics
Community Discussion
No community discussion yet for this question.