34. A university employee has logged on to an academic server and attempted to guess the system administrator's login credentials. Which of the following security measures should the university have implemented to detect the employee's attempts to gain access to the administrator's accounts?
Answer: D
User activity logs are essential for detecting unauthorized access attempts.
User activity logs would enable the university to monitor and record the actions taken by users on the academic server, allowing for the identification of any unauthorized attempts to access the system administrator's login credentials.
A) Two-factor authentication
While two-factor authentication is an important security measure that adds an extra layer of protection by requiring a second form of verification, it does not directly provide a mechanism to detect access attempts. Instead, it prevents unauthorized access by requiring additional proof of identity.
B) Firewall
A firewall serves to filter incoming and outgoing network traffic based on predetermined security rules, and while it can help block unauthorized access, it does not specifically log user activity or provide details about attempts to guess credentials. Therefore, a firewall alone would not be sufficient for detecting the employee's behavior.
C) Intrusion prevention system
An intrusion prevention system (IPS) can actively monitor and respond to suspicious activity, but its primary function is to block malicious traffic rather than to log user actions in detail. Although it could provide some insights, it is not primarily focused on capturing user activity logs, which are crucial for this scenario.
D) User activity logs
User activity logs are critical for tracking actions taken by users on a server. They provide a comprehensive record of login attempts, including failed attempts, which would enable the university to detect any unauthorized access attempts, such as the employee's efforts to guess the system administrator's credentials.
Conclusion
User activity logs are the most effective measure for detecting unauthorized access attempts, as they capture detailed information about user interactions with the system. Other options, while beneficial for security, do not specifically address the need to monitor and detect login attempts, making them less suitable in this context.