A high volume of failed RDP authentication attempts was logged on a critical server within a one- hour period. All of the attempts originated from the same remote IP address and made use of a single…

Question

Options

• AEnabling a user account lockout after a limited number of failed attempts
• BInstalling a third-party remote access tool and disabling RDP on all devices
• CImplementing a firewall block for the remote system's IP address
• DIncreasing the verbosity of log-on event auditing on all devices

• A
  80% (16)
• B
  5% (1)
• C
  5% (1)
• D
  10% (2)

Explanation

Explanation

Enabling account lockout after a limited number of failed attempts directly neutralizes a brute-force attack by temporarily or permanently disabling the targeted account after a threshold is crossed, making it statistically impossible for the attacker to cycle through enough passwords to succeed. Option B is incorrect because simply switching remote access tools doesn't address the brute-force behavior itself - the attacker could pivot to the new tool - and disabling RDP on all devices is an overly disruptive, disproportionate response. Option C (blocking the IP address) seems appealing but is a reactive, easily bypassed control, as the attacker can simply rotate to a different IP address and resume the attack. Option D increases visibility into the attack but provides no mitigation - more detailed logs help with detection and forensics, not with stopping the brute-force from succeeding.

Memory Tip

Think "lock the door, not just watch the door" - logging (D) only watches, IP blocks (C) can be walked around, and changing doors (B) doesn't solve the problem. An account lockout physically stops the attack at the point of entry by cutting off the attacker's ability to keep guessing.

No community discussion yet for this question.