Quick Answer

The answer is an account that has been inactive for 90 days suddenly authenticating to a critical server, alongside multiple failed logon attempts followed by a single successful logon from the same source IP address. This combination directly points to a credential-based attack because the sudden reactivation of a dormant account often indicates an attacker has compromised stale credentials, while the failure-to-success pattern is the hallmark of a password spraying or brute-force attack—the attacker tries many passwords until one works, then uses the successful authentication to gain a foothold. On the CompTIA CySA+ CS0-003 exam, this question tests your ability to correlate behavioral anomalies with known attack patterns, and a common trap is focusing only on the failures without recognizing that the single success is the critical indicator of compromise. Remember the mnemonic “Dormant Dawns, Failures Flip”—a dormant account waking up and a flip from failures to success both signal credential theft.