nerdexam
CompTIA

SY0-301 · Question #565

Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts? Host 192.168.1.123 [00:00:01]Successful…

The correct answer is D. Hardening. The log shows repeated failed RDP login attempts from an external IP address in rapid succession, indicating an active brute-force attack against RDP. Hardening - such as disabling RDP if unused, enforcing account lockout, or restricting RDP access - is the appropriate…

Security operations

Question

Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts? Host 192.168.1.123 [00:00:01]Successful Login: 015 192.168.1.123 : local [00:00:03]Unsuccessful Login: 022 214.34.56.006 :RDP 192.168.1.124 [00:00:04]UnSuccessful Login: 010 214.34.56.006 :RDP 192.168.1.124 [00:00:07]UnSuccessful Login: 007 214.34.56.006 :RDP 192.168.1.124 [00:00:08]UnSuccessful Login: 003 214.34.56.006 :RDP 192.168.1.124

Options

  • AReporting
  • BIDS
  • CMonitor system logs
  • DHardening

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    12% (3)
  • D
    80% (20)

Why each option

The log shows repeated failed RDP login attempts from an external IP address in rapid succession, indicating an active brute-force attack against RDP. Hardening - such as disabling RDP if unused, enforcing account lockout, or restricting RDP access - is the appropriate mitigation.

AReporting

Reporting the incident does not technically mitigate the ongoing brute-force attack or prevent future attempts from succeeding.

BIDS

An IDS would detect and alert on the attack pattern but would not block or prevent the RDP brute-force attempts from continuing.

CMonitor system logs

Monitoring system logs is already occurring as evidenced by the log excerpt, and passive monitoring alone does not stop the attack.

DHardeningCorrect

Hardening the systems by disabling or restricting RDP access, enforcing account lockout policies, and blocking the source IP would directly mitigate the observed brute-force attack pattern. System hardening addresses the root cause by reducing the exposed attack surface that the attacker is exploiting. This is more effective than passive measures because it actively prevents the attack vector from being usable.

Concept tested: RDP brute-force attack mitigation through hardening

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-policy

Topics

#log analysis#brute force#RDP attacks#system hardening

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice