Information Technology Specialist (ITS) Cybersecurity Practice Exam

Which Windows log files should be examined to provide evidence of a potential brute force attack on a server?

1. Application logs

2. System logs

3. Security logs

4. Setup logs

The correct answer is: Security logs

The correct choice is the security logs. These logs are specifically designed to record events related to security actions, including successful and failed login attempts. When investigating a potential brute force attack, security logs provide crucial information about repeated failed login attempts from the same IP address, along with timestamps that can indicate patterns suggestive of an attack. Brute force attacks typically involve an attacker trying to gain unauthorized access to an account by repeatedly guessing passwords. The security logs capture these login attempts, which can help to identify and respond to such threats. In contrast, application logs focus on events and errors related to individual applications, system logs track the operating system's operational events, and setup logs provide information regarding installations and configurations. While these other logs may contain useful information for broader troubleshooting, they do not specifically provide the detailed login attempt information necessary to detect brute force attacks effectively. Thus, the examination of security logs is essential for identifying and mitigating potential brute force attack scenarios.