A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.
Which of the following actions would BEST address the potential risks by the activity in the logs?
A. Alerting the misconfigured service account password
B. Modifying the AllowUsers configuration directive
C. Restricting external port 22 access
D. Implementing host-key preferences
A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. T
-
answerhappygod
- Site Admin
- Posts: 899604
- Joined: Mon Aug 02, 2021 8:13 am
A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. T
Join a community of subject matter experts. Register for FREE to view solutions, replies, and use search function. Request answer by replying!