Exam GCIH All QuestionsBrowse all questions from this exam
Question 123

During the identification phase of a Web server compromise, you notice the following entries in the web server logs. If "admin" is a valid username, but its corresponding password is not "pass1", and "root" is not a valid username, what can you infer solely from these logs?

    Correct Answer: D

    The log entries show multiple attempts to access the phpMyAdmin interface with different usernames and a constant password. The usernames 'admin' and 'root' are commonly targeted in brute force attacks, and the multiple other usernames (like Alice, Bob, Jim) suggest an attempt to guess the valid login credentials through repeated trial-and-error methods. The constant use of 'pass1' further indicates the goal is to find any valid username-password combination. Therefore, the pattern in the logs is consistent with a password brute-forcing attack.

Discussion
XBalOption: B

Answer is "B"