Security Operations →mediumMultiple ChoiceObjective-mapped

SY0-701 Security Operations Practice Question

A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?

⚠ Common exam trap

Candidates often confuse 'multiple failed attempts from various IPs' with credential stuffing, but the key differentiator is that credential stuffing uses known credential pairs, not systematically generated passwords against a single account.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute-force attack

(Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Brute-force attack
Why this is correct
Correct. A brute-force attack is characterized by systematically trying many different passwords against a single account until the correct one is found. The log pattern of multiple failed attempts followed by a success aligns with this method.
✗
Credential stuffing
Why it's wrong here
Incorrect. Credential stuffing uses previously leaked username and password pairs from other breaches. It typically shows many failed attempts but often with the same password tried across different accounts, not many different passwords against one account.
When this WOULD be correct
A security analyst sees multiple failed logins with the same username but different passwords, and later a successful login from a known breached credential list; the question would specify that the successful login used a password found in a recent data breach.
✗
Password spraying
Why it's wrong here
Incorrect. Password spraying involves using a small number of common passwords against many different accounts to avoid lockout thresholds. The scenario describes many attempts against a single account, which is the opposite of password spraying.
When this WOULD be correct
Password spraying would be correct if the question described multiple failed login attempts using the same password (e.g., 'Password123') across many different user accounts, followed by a successful login from an unusual location.
✗
Dictionary attack
Why it's wrong here
Incorrect. A dictionary attack uses a list of common words or phrases as password guesses. While it is a type of brute-force, the term 'dictionary attack' implies a specific subset of guesses. The scenario suggests a more exhaustive, non-dictionary-based iteration (e.g., alphanumeric combinations) typical of a general brute-force attack.
When this WOULD be correct
A dictionary attack would be correct if the question stated that the attacker used a wordlist of common passwords (e.g., 'password123', 'admin') against a single account, and the failed attempts showed passwords from that list, not random or systematically generated ones.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

✓Brute-force attackCorrect answer▾

Why this is correct

Correct. A brute-force attack is characterized by systematically trying many different passwords against a single account until the correct one is found. The log pattern of multiple failed attempts followed by a success aligns with this method.

✗Credential stuffingWrong answer — click to see why▾

Why this is wrong here

Credential stuffing uses previously breached username/password pairs from other services, but the question states the failed attempts used different passwords, not reused credentials from breaches.

★ When this WOULD be the correct answer

A security analyst sees multiple failed logins with the same username but different passwords, and later a successful login from a known breached credential list; the question would specify that the successful login used a password found in a recent data breach.

Why candidates choose this

Candidates may confuse any attack using multiple passwords with credential stuffing, not realizing that credential stuffing specifically relies on reused credentials from prior breaches, not random password attempts.

✗Password sprayingWrong answer — click to see why▾

Why this is wrong here

Password spraying involves trying a single common password against many user accounts, not multiple passwords against a single account as described in the question.

★ When this WOULD be the correct answer

Password spraying would be correct if the question described multiple failed login attempts using the same password (e.g., 'Password123') across many different user accounts, followed by a successful login from an unusual location.

Why candidates choose this

Candidates may confuse password spraying with brute-force because both involve multiple login attempts, but they fail to note that password spraying targets many accounts with one password, while this scenario targets one account with many passwords.

✗Dictionary attackWrong answer — click to see why▾

Why this is wrong here

A dictionary attack uses a predefined list of likely passwords (e.g., common words or variations) against a single account, but the question describes failed attempts with 'different passwords' from various IPs, which is more consistent with a brute-force attack that systematically tries many passwords.

★ When this WOULD be the correct answer

A dictionary attack would be correct if the question stated that the attacker used a wordlist of common passwords (e.g., 'password123', 'admin') against a single account, and the failed attempts showed passwords from that list, not random or systematically generated ones.

Why candidates choose this

Candidates may confuse 'dictionary attack' with any attack that tries multiple passwords, but the key distinction is that dictionary attacks use a curated list of likely passwords, not exhaustive or random attempts.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

SY0-701 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question