CS0-003 · Question #466
In the last hour, a high volume of failed RDP authentication attempts has been logged on a critical server. All of the authentication attempts originated from the same remote IP address and made use o
The correct answer is C. Configure user account lockout after a limited number of failed attempts. F. Block inbound to TCP port 3389 from untrusted remote IP addresses at the perimeter firewall.. To mitigate brute-force attacks, implementing an account lockout policy (C) prevents continuous attempts by locking the account after a set number of failed logins. Blocking inbound connections on TCP port 3389 (RDP) from untrusted IP addresses (F) limits access, reducing the att
Question
In the last hour, a high volume of failed RDP authentication attempts has been logged on a critical server. All of the authentication attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following mitigating controls would be most effective to reduce the rate of success of this brute-force attack? (Choose two.)
Options
- AIncrease the granularity of log-on event auditing on all devices.
- BEnable host firewall rules to block all outbound traffic to TCP port 3389.
- CConfigure user account lockout after a limited number of failed attempts.
- DImplement a firewall block for the IP address of the remote system.
- EInstall a third-party remote access tool and disable RDP on all devices.
- FBlock inbound to TCP port 3389 from untrusted remote IP addresses at the perimeter firewall.
How the community answered
(37 responses)- A14% (5)
- B8% (3)
- C73% (27)
- D3% (1)
- E3% (1)
Explanation
To mitigate brute-force attacks, implementing an account lockout policy (C) prevents continuous attempts by locking the account after a set number of failed logins. Blocking inbound connections on TCP port 3389 (RDP) from untrusted IP addresses (F) limits access, reducing the attack
Topics
Community Discussion
No community discussion yet for this question.