CAS-004 Exam Question 81
A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.
Which of the following actions would BEST address the potential risks by the activity in the logs?
Which of the following actions would BEST address the potential risks by the activity in the logs?
CAS-004 Exam Question 82
A security analyst is reviewing the following output:
Which of the following would BEST mitigate this type of attack?
Which of the following would BEST mitigate this type of attack?