SY0-301 · Question #565
Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts? Host 192.168.1.123 [00:00:01]Successful…
The correct answer is D. Hardening. The log shows repeated failed RDP login attempts from an external IP address in rapid succession, indicating an active brute-force attack against RDP. Hardening - such as disabling RDP if unused, enforcing account lockout, or restricting RDP access - is the appropriate…
Question
Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts? Host 192.168.1.123 [00:00:01]Successful Login: 015 192.168.1.123 : local [00:00:03]Unsuccessful Login: 022 214.34.56.006 :RDP 192.168.1.124 [00:00:04]UnSuccessful Login: 010 214.34.56.006 :RDP 192.168.1.124 [00:00:07]UnSuccessful Login: 007 214.34.56.006 :RDP 192.168.1.124 [00:00:08]UnSuccessful Login: 003 214.34.56.006 :RDP 192.168.1.124
Options
- AReporting
- BIDS
- CMonitor system logs
- DHardening
How the community answered
(25 responses)- A4% (1)
- B4% (1)
- C12% (3)
- D80% (20)
Why each option
The log shows repeated failed RDP login attempts from an external IP address in rapid succession, indicating an active brute-force attack against RDP. Hardening - such as disabling RDP if unused, enforcing account lockout, or restricting RDP access - is the appropriate mitigation.
Reporting the incident does not technically mitigate the ongoing brute-force attack or prevent future attempts from succeeding.
An IDS would detect and alert on the attack pattern but would not block or prevent the RDP brute-force attempts from continuing.
Monitoring system logs is already occurring as evidenced by the log excerpt, and passive monitoring alone does not stop the attack.
Hardening the systems by disabling or restricting RDP access, enforcing account lockout policies, and blocking the source IP would directly mitigate the observed brute-force attack pattern. System hardening addresses the root cause by reducing the exposed attack surface that the attacker is exploiting. This is more effective than passive measures because it actively prevents the attack vector from being usable.
Concept tested: RDP brute-force attack mitigation through hardening
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-policy
Topics
Community Discussion
No community discussion yet for this question.