mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A SOC analyst notices repeated failed login…
A SOC analyst notices repeated failed login attempts from a single IP address against multiple user accounts. Which type of attack is most likely occurring?
⚠ Common exam trap
Cisco often tests the distinction between brute force (many passwords, one user) and password spraying (one password, many users), where candidates mistakenly choose brute force because they focus on the 'repeated failed login attempts' without noticing the attack is spread across multiple accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying
Password spraying (C) is correct because the attack involves a single IP address attempting the same common password against multiple user accounts. This technique avoids account lockout policies that typically trigger after a few failed attempts on a single account, making it distinct from brute force attacks that target one account with many passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Credential stuffing
Why it's wrong here
Credential stuffing uses breached username/password pairs, not single IP.
- ✗
Brute force attack
Why it's wrong here
Brute force focuses on one account; here multiple accounts are targeted.
- ✓
Password spraying
Why this is correct
Password spraying tries a few common passwords across many accounts.
- ✗
Man-in-the-middle attack
Why it's wrong here
MITM intercepts communications, not login attempts.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.