Discuss EC-Council ECSS Exam Topic 7 Question 123

Robert, a security specialist, was appointed to strengthen the security of the organization's network. To prevent multiple login attempts from unknown sources, Robert implemented a security strategy of issuing alerts or warning messages when multiple failed login attempts are made.

Which of the following security risks is addressed by Robert to make attempted break-ins unsuccessful?

AIndefinite session timeout

BAbsence of account lockout for invalid session IDs

CSmall session-ID generation

DWeak session-ID generation

Suggested Answer: B

Robert's strategy of issuing alerts or warning messages when multiple failed login attempts occur is aimed at addressing the risk ofabsence of account lockout for invalid session IDs.By locking out accounts temporarily after a certain number of failed login attempts, Robert prevents attackers from repeatedly guessing passwords or trying different session IDs to gain unauthorized access.Reference: EC-Council Certified Security Specialist (E|CSS) documents and study guide12.

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Coletta 2 days ago

But Robert's strategy directly targets failed logins, so B makes sense.

India 8 days ago

I feel like D could also be a concern. Weak IDs are risky.

Marla 13 days ago

Agreed! Multiple failed attempts should trigger a lockout.

Mila 18 days ago

I think it's B. Account lockout is crucial.

Pamella 23 days ago

I see the point, but D is still a big risk.

Sherly 28 days ago

Definitely B. Alerts are not enough without lockout.

Maryanne 1 month ago

I vote for B too. Lockout prevents brute force attacks.

Adelina 1 month ago

True, but weak IDs can lead to easier breaches.

Nohemi 1 month ago

But B directly addresses the login attempts issue.

Arthur 2 months ago

I feel like D is also a concern. Weak IDs can be exploited.

Thurman 2 months ago

Agreed! Multiple attempts should trigger a lockout.

Selene 2 months ago

I think it's B. Account lockout is crucial.

Dorethea 2 months ago

Agreed, but I wonder if it covers all possible threats.

Dion 2 months ago

Definitely a good strategy, but what about session timeouts?

Aja 2 months ago

Wait, are alerts really enough? Seems a bit basic.

Jamie 3 months ago

I think this mainly addresses option B.

Kenny 3 months ago

Sounds like a solid move to prevent brute force attacks!

Theresia 3 months ago

I believe Robert's strategy is addressing the absence of account lockout, which is crucial for preventing brute-force attacks.

Tricia 3 months ago

I’m a bit confused about the options. I thought weak session-ID generation was more about how IDs are created, not failed logins.

In 3 months ago

This question feels similar to one we practiced on session management risks. I think it might relate to account lockout.

Sylvie 4 months ago

I remember studying about account lockout mechanisms, but I'm not sure if that's the main focus here.

EC-Council ECSS Exam - Topic 7 Question 123 Discussion