CompTIA CySA+ Practice Test

What should be done to secure an SSH server where password authentication attempts are repeatedly failing?

1. Enable password authentication

2. Disable password authentication

3. Allow root logins

4. Install additional firewalls

The correct answer is: Disable password authentication

Disabling password authentication is a critical step in securing an SSH server when failed attempts are repeatedly observed. Continuous password authentication failures may indicate that an attacker is trying to gain unauthorized access through brute force methods. By disabling this option, you eliminate the possibility of password-based exploits. Furthermore, disabling password authentication often encourages the use of more secure methods, such as key-based authentication. Key-based authentication significantly enhances security, as it requires possession of a private key in addition to knowledge of the username. This is much harder for attackers to compromise compared to simply guessing or cracking a password. Enabling password authentication, allowing root logins, or installing additional firewalls does not directly address the specific issue of repeated failed password attempts and may expose the server to further vulnerabilities.