hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A company uses a SIEM platform that ingests logs…
A company uses a SIEM platform that ingests logs from various sources. The SOC team receives an alert for a high number of failed login attempts (over 100 in 5 minutes) on the domain controller from a single IP address. The analyst investigates and finds that the failed attempts are for multiple different usernames, including some disabled accounts. The source IP is traced to an external VPN service. The analyst also notices that a few accounts had successful logins from the same IP after the failed attempts. Which of the following is the MOST likely attack type?
⚠ Common exam trap
CompTIA often tests the distinction between brute-force (many passwords, one user) and password spraying (one password, many users), and candidates mistakenly choose brute-force because they see 'failed login attempts' without analyzing the username distribution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying.
The attack involves a single external IP attempting logins with multiple different usernames (including disabled accounts) and eventually succeeding on a few. This is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid triggering account lockout policies. The use of an external VPN service indicates the attacker is anonymizing their origin, and the successful logins after failures confirm the attack's objective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-force attack.
Why it's wrong here
A traditional brute-force attack involves systematically trying numerous password combinations against a *single* user account until the correct one is found. This method typically generates a high volume of failed login attempts for that specific account within a short timeframe, which would quickly trigger account lockout policies and alert security systems. Therefore, it does not align with a scenario where an attacker attempts a few common passwords across *many* different accounts to avoid detection.
- ✗
Kerberoasting.
Why it's wrong here
Kerberoasting is an attack technique used to obtain service account hashes from Active Directory. An attacker requests a Kerberos Ticket Granting Service (TGS) ticket for a service principal name (SPN) associated with a service account. The domain controller encrypts this TGS ticket using the service account's NTLM hash, which the attacker can then extract and attempt to crack offline. This process does not involve direct login attempts against user accounts and thus would not manifest as failed login attempts in a SIEM.
- ✓
Password spraying.
Why this is correct
Password spraying is a low-and-slow attack method where an attacker attempts a small number of very common passwords (e.g., "Summer2023!", "Password123") against a large list of user accounts. The primary goal is to avoid triggering account lockout policies, which are typically configured to lock an account after a few failed attempts. By distributing the attempts across many accounts, the attacker hopes to find a match for at least one account without generating a high volume of failed logins for any single user, making it harder to detect.
- ✗
Pass-the-hash.
Why it's wrong here
Pass-the-hash (PtH) is a post-exploitation technique where an attacker authenticates to a remote system or service using a captured NTLM hash of a user's password, rather than the plaintext password itself. Since the hash is directly used for authentication, the system processes it as a valid credential, bypassing the need for a password and thus generating successful authentication events, not failed login attempts. This method exploits weaknesses in how Windows handles authentication tokens and cached credentials.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.