You are a Linux administrator for a small company.
Nopal Securities technical mcq question, verified with a worked answer. Free to practise - no sign-up.
You are a Linux administrator for a small company. One morning, you notice multiple failed login attempts for the root account on your web server. The attempts seem to originate from a foreign IP address. What is the best first step to take in response to this situation?
Show answer & explanation
Blocking the offending foreign IP address immediately stops active automated brute force attempts without causing service disruption or locking legitimate administrator access.
Step-by-step Derivation:
Step 1: An external IP is attempting brute-force authentication against root.
Step 2: Immediate mitigation requires stopping ingress traffic from the malicious source.
Step 3: Adding a firewall rule (e.g. iptables/ufw drop) directly halts the attack.