Unlimited Access

Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.

Get Unlimited Access

Comptia Discussions

Exam CS0-003 topic 1 question 220 discussion

Actual exam question from CompTIA's CS0-003

Question #: 220
Topic #: 1

[All CS0-003 Questions]

A high volume of failed RDP authentication attempts was logged on a critical server within a one-hour period. All of the attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following would be the most effective mitigating control to reduce the rate of success of this brute-force attack?

A. Enabling a user account lockout after a limited number of failed attempts
B. Installing a third-party remote access tool and disabling RDP on all devices
C. Implementing a firewall block for the remote system's IP address
D. Increasing the verbosity of log-on event auditing on all devices

Show Suggested Answer

Suggested Answer: A 🗳️

by jspecht at March 5, 2024, 8:49 p.m.

Comments

Submit Cancel

badgerino

11 hours, 55 minutes ago

Selected Answer: A

Locking down a administrator account especially if it's a production account can be disruptive, I don't like the options CompTIA gives here. A better answer would be to setup whitelisting from specific IP addresses. Locking the account due to many failed attemps can cause A LOT of problems. What is stopping the attacker from doing it again? Blocking them IP address here, would make the most real world practical sense as it does not affect production. But they can easily switch IP addresses, so that's why I think setting up whitelisting would be a better option, or even setting up rate limiting or requiring MFA are better options too. I'm gonna go with A, but I don't really agree with either of these answers.

upvoted 1 times

...