200-201 Security Monitoring Practice Question
An analyst is reviewing a Windows event log and sees Event ID 4625 repeated many times for the same user account from different source workstations within a short period. Which activity does this most likely indicate?
⚠ Common exam trap
The trap here is treating all 4625 events as routine user error, when a high volume from multiple hosts signals an active credential attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A brute-force or password-spraying attack against the account
Repeated Windows Event ID 4625 entries for one account from multiple source workstations indicate many failed logon attempts, which is the signature of a brute-force or password-spraying attack. Legitimate causes such as expired passwords or stale cached credentials would not produce this volume or diversity of source hosts, so the activity should be investigated as a credential attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A successful privilege escalation by a domain administrator
Why it's wrong here
Successful privilege escalation would generate Event ID 4672 (special privileges assigned) or 4624 with elevated logon types, not repeated 4625 failures. Event ID 4625 specifically records failed logons, so its presence indicates unsuccessful authentication attempts rather than a successful escalation. The multiple source workstations further point to an external attack rather than legitimate administrative activity.
- ✓
A brute-force or password-spraying attack against the account
Why this is correct
Event ID 4625 is generated on failed logon attempts. A high volume of these events for one account, especially from multiple source workstations, suggests an attacker is trying many passwords. Password spraying uses a few common passwords across many accounts, but repeated failures for a single account from different hosts also align with brute-force or credential-stuffing activity targeting that account.
- ✗
A user account lockout due to a stale cached credential
Why it's wrong here
A stale cached credential typically causes a small, consistent number of 4625 events from a single machine, often at logon time, until the credential is updated. The scenario shows many failures from different source workstations, which is not consistent with one stale credential. While a lockout may occur as a side effect, the underlying pattern here indicates a broader attack.
- ✗
Normal user behavior when a password has expired
Why it's wrong here
An expired password would produce a limited number of 4625 events from the user's own workstation, usually followed by a successful password change. Repeated failures from multiple different workstations are not typical of a single user with an expired password. This pattern suggests an attacker using multiple sources to guess credentials rather than a routine password expiration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.