Exam CS0-003 topic 1 question 220 discussion

Actual exam question from CompTIA's CS0-003

Question #: 220
Topic #: 1

A high volume of failed RDP authentication attempts was logged on a critical server within a one-hour period. All of the attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following would be the most effective mitigating control to reduce the rate of success of this brute-force attack?

A. Enabling a user account lockout after a limited number of failed attempts
B. Installing a third-party remote access tool and disabling RDP on all devices
C. Implementing a firewall block for the remote system's IP address
D. Increasing the verbosity of log-on event auditing on all devices

Show Suggested Answer

Suggested Answer: A 🗳️

by jspecht at March 5, 2024, 8:49 p.m.

Comments

Submit Cancel

jspecht

Highly Voted 1 year, 4 months ago

Selected Answer: A

Account lockout is the best defense against brute-force attacks.

upvoted 7 times

...

badgerino

Most Recent 12 months ago

Selected Answer: A

Locking down a administrator account especially if it's a production account can be disruptive, I don't like the options CompTIA gives here. A better answer would be to setup whitelisting from specific IP addresses. Locking the account due to many failed attemps can cause A LOT of problems. What is stopping the attacker from doing it again? Blocking them IP address here, would make the most real world practical sense as it does not affect production. But they can easily switch IP addresses, so that's why I think setting up whitelisting would be a better option, or even setting up rate limiting or requiring MFA are better options too. I'm gonna go with A, but I don't really agree with either of these answers.

upvoted 3 times

...