GCIH Exam QuestionsBrowse all questions from this exam

GCIH Exam - Question 125


During the identification phase of a Web server compromise, you notice the following entries in the web server logs. If "admin" is a valid username, but its corresponding password is not "pass1", and "root" is not a valid username, what can you infer solely from these logs?

Exam GCIH Question 125
Show Answer
Correct Answer: D

The log entries show multiple attempts to access the phpMyAdmin interface with different usernames and a constant password. The usernames 'admin' and 'root' are commonly targeted in brute force attacks, and the multiple other usernames (like Alice, Bob, Jim) suggest an attempt to guess the valid login credentials through repeated trial-and-error methods. The constant use of 'pass1' further indicates the goal is to find any valid username-password combination. Therefore, the pattern in the logs is consistent with a password brute-forcing attack.

Discussion

1 comment
Sign in to comment
XBal
Sep 15, 2024

Answer is "B"