Skip to content
AI Security

Interview question · Systems, OS & Memory Safety

How do fail2ban and CrowdSec protect an SSH or web server, and what attacks do they not stop?

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

mediumNewPreparation tags: Cloudflare, Amazon, GoogleUpdated Nov 2026

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 5 follow-ups like an interviewer would

A small team runs one internet-facing Linux server with SSH open and an nginx site behind a CDN. Their auth log shows thousands of failed SSH logins a day, and someone proposes installing fail2ban as the fix.

  1. What does fail2ban actually do with those failed logins?
  2. What if the guessing comes from 5,000 addresses, two attempts each?
  3. What if they add a jail for the website, which sits behind the CDN?
  4. What if a user complains that their whole office is locked out?
  5. What would you actually deploy?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackHow would you secure SSH access to a fleet of Linux servers: keys, SSH certificates, bastions and revocation?Next in this trackWhy does publishing a security patch increase risk for anyone who has not applied it yet, and how do defenders shorten that window?Next in this trackAI agents can now drive Ghidra and debuggers through MCP. What does that speed up, and what new risks does it add?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.