200-201 Host-Based Analysis Practice Question
An analyst is reviewing Windows Event Logs and sees multiple Event ID 4625 entries from a single IP address. What does this indicate?
⚠ Common exam trap
The trap is confusing Event ID 4625 with other logon-related events like 4624 (success) or 4740 (lockout); candidates might also think multiple failures indicate a lockout, but lockout is a separate event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A brute-force password guessing attack.
Event ID 4625 in Windows Security logs indicates a failed logon attempt. Multiple such events from a single IP address suggest a brute-force password guessing attack, where an attacker repeatedly tries different passwords. This pattern is a classic indicator of compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A user account was locked out.
Why it's wrong here
Account lockout is a downstream consequence logged separately as 4740, not the direct meaning of 4625. It tempts because repeated failed logons do eventually trigger lockout, but the stem asks what the 4625 entries themselves indicate: failed authentication attempts, not the resulting lockout event.
- ✓
A brute-force password guessing attack.
Why this is correct
Event ID 4625 records a failed logon attempt. Many such entries originating from one IP address indicate repeated authentication failures, the signature of a brute-force password guessing attack, rather than a single mistyped password or a successful compromise.
- ✗
A service account password expired.
Why it's wrong here
A single expired service account password produces 4625 failures only for that account, not repeated attempts from one source IP. It tempts because expired credentials genuinely generate 4625, but the stem's pattern across a single IP indicates password guessing against accounts rather than one stale service credential.
- ✗
Successful remote logins from that IP.
Why it's wrong here
Event ID 4625 records failed logon attempts, so it cannot indicate successful remote logins; success is logged as 4624. It tempts because 4624 with Logon Type 10 does confirm Remote Desktop success, but the stem's repeated 4625 entries from one IP point to brute-force failures instead.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.