CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  True positive for a brute-force attack

  Why this is correct

  This scenario represents a classic true positive for a brute-force attack, where an attacker systematically attempts numerous credential combinations against a single account from a single source IP until succeeding. The sequence of multiple rapid authentication failures followed immediately by a successful login is a high-fidelity indicator of compromise (IoC) that confirms the attack was successful.

• ✗

  False positive due to a misconfigured application

  Why it's wrong here

  While a misconfigured service or API client using stale credentials will generate continuous authentication failures, it would not suddenly achieve a successful login without administrative intervention. The transition from repeated failures to a single success from the same remote IP strongly points to active credential guessing rather than a static configuration error.

• ✗

  False positive due to user error

  Why it's wrong here

  A legitimate user might mistype their password a few times, but they rarely generate the high volume of rapid failures typically associated with automated brute-forcing. Furthermore, security analysts must treat a successful login following a dense cluster of failures from an external IP as an active compromise rather than dismissing it as benign user clumsiness.

• ✗

  True positive for a password spraying attack

  Why it's wrong here

  Password spraying is a distinct horizontal brute-force technique where an attacker tests a single common password (like 'Password123') across many different user accounts to evade account lockout policies. In contrast, this alert details a vertical brute-force pattern, which targets a single account with many different password attempts from a single source.

Go deeper

Related to this question