AP Cybersecurity Drill 30: Incident Triage Across Defenses

Question 1. How many failed sign-in attempts for jvargas appear in the log before the successful one?

• A) Four failed sign-in attempts appear before the success
• B) Five failed sign-in attempts appear before the success
• C) Seven failed sign-in attempts appear before the success
• D) Six failed sign-in attempts appear before the success ✓

Explanation: Choice D is correct. The log lists six rows marked Failed for jvargas, then a seventh row marked Success, so six failures precede the success. Choice A is incorrect because four undercounts the failed rows. Choice B is incorrect because five also undercounts by one. Choice C is incorrect because seven counts the success row as a failure; only six rows are failures.

Question 2. Using the lockout policy, why did the account never lock during this sequence?

• A) The six failures stayed below the 8-attempt threshold, and the success then reset the counter ✓
• B) The lockout policy applies only during normal business hours, and these attempts came at night
• C) The account was already locked at the time, so the failed attempts were not counted at all
• D) Each failure came from a different source address, so none of them counted toward one total

Explanation: Choice A is correct. The policy locks an account after 8 consecutive failures, but only six occurred before a success, which then reset the counter to zero, so the threshold was never reached. Choice B is incorrect because the policy states no business-hours limitation. Choice C is incorrect because the log shows the account was reachable and the attempts were recorded, not blocked by an existing lock. Choice D is incorrect because the log attributes all attempts to the same account, and the policy counts consecutive failures regardless of source.

Question 3. Reading all three sources together, what does the sequence of events most likely indicate?

• A) A routine password change by jvargas that was followed by some ordinary administrative cleanup
• B) A backup job that kept retrying the sign-in until it finally authenticated with the right secret
• C) A network outage that briefly caused several normal sign-ins to be recorded as failures by mistake
• D) A successful password-guessing attempt followed by an unauthorized firewall change ✓

Explanation: Choice D is correct. Repeated failures ending in a success point to a guessed or cracked password, and the same session then added a broad remote-desktop allow rule outside the change process, which together read as an intrusion. Choice A is incorrect because a routine change would not be preceded by six failed sign-ins or skip the change process. Choice B is incorrect because a backup job would use stored credentials, not produce a burst of failures. Choice C is incorrect because an outage would not explain the deliberate, unrequested firewall change from that session.

Question 4. Which single record detail most strongly signals that the successful sign-in should be treated as malicious rather than routine?

• A) The session immediately added a broad allow rule for remote desktop outside the change process ✓
• B) The sign-in attempts all occurred late in the evening rather than during normal daytime working hours
• C) The account name jvargas does not by itself make clear which specific employee it belongs to
• D) The lockout policy uses a 15-minute duration rather than a longer and stricter lockout window

Explanation: Choice A is correct. Opening remote desktop to any source right after the successful sign-in, without going through the change process, is the action that marks the session as hostile rather than a normal login. Choice B is incorrect because the late hour is mildly suspicious but is not itself evidence of malice. Choice C is incorrect because an unclear account name is a naming concern, not evidence about this session. Choice D is incorrect because the lockout duration describes policy and says nothing about whether this sign-in was malicious.

Question 5. Considering defense in depth, which response best contains this incident across more than one layer?

• A) Reset the jvargas password and assume the single change was harmless once the password is strong
• B) Remove only the new firewall rule and leave the jvargas session active to watch what it does next during triage
• C) Reset the jvargas credentials, terminate active jvargas sessions, remove the unauthorized firewall rule, and review the account's recent activity ✓
• D) Lower the lockout threshold to 3 attempts and treat that change as enough to close the incident

Explanation: Choice C is correct. A layered response addresses each affected control: resetting the compromised credentials and terminating the active session close the access path, removing the unauthorized rule restores the firewall, and reviewing recent activity checks for further damage. Choice A is incorrect because resetting the password while leaving the rogue firewall rule in place ignores a second layer that is already weakened. Choice B is incorrect because leaving a likely-compromised session active to observe it risks further harm. Choice D is incorrect because tightening the lockout threshold is a useful hardening step but does nothing about the access already gained or the firewall change.