GSLC · Question #586
Joe, a security administrator, believes that a network breach has occurred in the datacenter as a result of a misconfigured router access list, allowing outside access to an SSH server. Which of the…
The correct answer is D. Connections to port 22. SSH operates on port 22, so confirming unauthorized outside access via the misconfigured ACL means searching logs for connections to that port.
Question
Joe, a security administrator, believes that a network breach has occurred in the datacenter as a result of a misconfigured router access list, allowing outside access to an SSH server. Which of the following should Joe search for in the log files?
Options
- AFailed authentication attempts
- BNetwork ping sweeps
- CHost port scans
- DConnections to port 22
How the community answered
(64 responses)- A8% (5)
- B2% (1)
- C3% (2)
- D88% (56)
Why each option
SSH operates on port 22, so confirming unauthorized outside access via the misconfigured ACL means searching logs for connections to that port.
Failed authentication attempts could indicate brute-force activity but would not directly confirm that outside access to the SSH server occurred due to the ACL misconfiguration.
Ping sweeps are used during reconnaissance to discover live hosts and are unrelated to exploiting SSH access through a misconfigured ACL.
Host port scans are a discovery technique used to enumerate open ports and are not indicative of a breach via SSH access.
SSH exclusively uses TCP port 22 for communication. Since the misconfigured router ACL allowed outside access to the SSH server, Joe should search log files for connections to port 22 to identify any unauthorized external sessions or access attempts that exploited this misconfiguration.
Concept tested: SSH port 22 log analysis for unauthorized access
Source: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
Topics
Community Discussion
No community discussion yet for this question.