AP Cybersecurity Drill 2: Login History and Weak Authentication

Question 1. How many failed login attempts appear in the log?

• A) Four
• B) Six
• C) Five ✓
• D) Seven

Explanation: Choice C is correct. The log shows five rows with Result Failed, all from 203.0.113.77 between 21:03 and 21:05, so the failed-attempt count is five. Choice A is incorrect. Four undercounts the failed rows; there are five. Choice B is incorrect. Six counts one of the successes as a failure. Choice D is incorrect. Seven is the total number of attempts, not the number that failed.

Question 2. The five failures followed quickly by a success from a single new address are most consistent with which kind of attack?

• A) An online password-guessing (brute-force) attack against the account ✓
• B) A distributed denial-of-service (DDoS) attack on the login service
• C) A cross-site scripting (XSS) attack injected through the library web page form fields
• D) An ARP poisoning attack redirecting traffic on the local network

Explanation: Choice A is correct. Several rapid failed logins from one source ending in a success is the pattern of online password guessing, where an attacker tries candidates until one works. Choice B is incorrect. A distributed denial-of-service attack floods a service from many sources to take it offline, not to log in. Choice C is incorrect. Cross-site scripting injects scripts into web pages and does not appear as repeated login failures. Choice D is incorrect. ARP poisoning redirects local network traffic and would not produce this login-failure pattern.

Question 3. Which observation most strongly supports treating the evening activity as unauthorized?

• A) The evening login attempts in the log all happened at some point after 9 p.m. that night
• B) The evening IP differs from the morning IP, and the patron denies any evening activity ✓
• C) The account is protected only by a single password, with no additional second factor set
• D) The morning login shown in the log succeeded on the patron's very first attempt that day

Explanation: Choice B is correct. The evening activity comes from a different source address than the morning login, and the patron says they did nothing that evening, which together point to someone other than the patron. Choice A is incorrect. The time of day alone does not show who was logging in; people use accounts in the evening legitimately. Choice C is incorrect. Password-only protection is a weakness but does not by itself prove the evening user was an imposter. Choice D is incorrect. A first-try success in the morning is consistent with the real patron, not evidence about the evening.

Question 4. Why does the account's password scheme make this attack easier to succeed?

• A) A last name plus a two-digit number is a small, predictable space an attacker can guess fast ✓
• B) Including the patron's last name in the password causes the server to encrypt it automatically
• C) Adding a two-digit number to the last name guarantees that the resulting password is unique
• D) A password built from a real name is automatically rejected by the login system as unsafe

Explanation: Choice A is correct. A last name combined with only a two-digit number yields very few possibilities, so an attacker can run through them quickly until one works. Choice B is incorrect. Including a name does not encrypt anything; encryption is unrelated to how the password is composed. Choice C is incorrect. A two-digit number does not make a password unique and in fact keeps the space small. Choice D is incorrect. Login systems do not automatically reject name-based passwords; the scheme here was allowed and is weak.

Question 5. Which change would most directly prevent a repeat of this specific attack?

• A) Ask the patron to log in only during normal daytime staffed library hours
• B) Hide the account login page so it is not indexed by public search engines
• C) Require a strong unique password and enable a second authentication factor ✓
• D) Change the account username to a considerably longer and far less easily guessable text string

Explanation: Choice C is correct. A strong unique password defeats quick guessing, and a second authentication factor blocks an attacker who has only the password, directly stopping this attack. Choice A is incorrect. Restricting login hours does not prevent guessing and burdens the legitimate patron. Choice B is incorrect. Hiding the page from search engines does nothing against an attacker who already reaches the login. Choice D is incorrect. A longer username helps a little but leaves the weak single-factor password as the real opening.