What action should security administrators take to find indicators of malicious activity after multiple failed login attempts?

What action should security administrators take to find indicators of malicious activity after multiple failed login attempts?

• A. Review network traffic
• B. Review authentication logs
• C. Change user permissions
• D. Install antivirus software

Answer: (B)

Reviewing authentication logs is essential for identifying indicators of malicious activity following multiple failed login attempts. Authentication logs provide a detailed record of login attempts, user account statuses, timestamps, and originating IP addresses. By analyzing this data, security administrators can determine patterns such as repeated login failures from the same IP address, which can indicate an attempted brute force attack or unauthorized access attempts. This information allows administrators to take appropriate actions, such as blocking suspicious IP addresses or enforcing account lockout policies, to enhance security. While reviewing network traffic can provide additional context, it may not specifically point to authentication-related issues. Changing user permissions may mitigate risks but won't directly help in identifying the current malicious activity. Installing antivirus software can protect against malware, but it does not directly address the analysis of failed login attempts or account compromise risks immediately. Therefore, focusing on authentication logs is the most direct and effective approach to investigate the situation and understand potential threats.

Reviewing authentication logs is essential for identifying indicators of malicious activity following multiple failed login attempts. Authentication logs provide a detailed record of login attempts, user account statuses, timestamps, and originating IP addresses. By analyzing this data, security administrators can determine patterns such as repeated login failures from the same IP address, which can indicate an attempted brute force attack or unauthorized access attempts. This information allows administrators to take appropriate actions, such as blocking suspicious IP addresses or enforcing account lockout policies, to enhance security.

While reviewing network traffic can provide additional context, it may not specifically point to authentication-related issues. Changing user permissions may mitigate risks but won't directly help in identifying the current malicious activity. Installing antivirus software can protect against malware, but it does not directly address the analysis of failed login attempts or account compromise risks immediately. Therefore, focusing on authentication logs is the most direct and effective approach to investigate the situation and understand potential threats.