hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst is reviewing a series of…
A security analyst is reviewing a series of failed login attempts on a critical server. The logs show that the source IP addresses are from multiple geographic regions and the usernames tried are all valid employees. The attempts occur every 5 minutes for the past hour. According to the company's security policy, which type of attack is most likely occurring, and what is the best immediate response?
⚠ Common exam trap
Cisco often tests the distinction between password spraying and credential stuffing by focusing on the source of credentials—password spraying uses guessed common passwords, while credential stuffing uses stolen credential pairs from data breaches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying; enforce multi-factor authentication immediately.
The attack pattern—valid usernames with low-frequency attempts from diverse IPs—is characteristic of password spraying, where an attacker tries a single common password against many accounts to avoid lockout thresholds. The best immediate response is to enforce multi-factor authentication (MFA), which renders the stolen or guessed password insufficient for access, mitigating the attack without relying on IP-based blocking that is ineffective against distributed sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Password spraying; enforce multi-factor authentication immediately.
Why this is correct
Password spraying uses a few passwords against many users; MFA mitigates this effectively.
- ✗
Credential stuffing; implement rate limiting.
Why it's wrong here
Credential stuffing uses stolen credentials; here usernames are valid but passwords unknown.
- ✗
Brute-force attack; add the IPs to a blocklist.
Why it's wrong here
Brute force often uses many attempts from one IP; here IPs vary, so it's likely password spraying.
- ✗
Dictionary attack; reset all employee passwords.
Why it's wrong here
Dictionary attack uses many passwords, but the pattern suggests spraying.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.