SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is reviewing authentication logs from a corporate web application. The logs show thousands of failed login attempts over the past hour. Each attempt uses a different username, but all attempts use the same password 'Spring2024!'. The source IP addresses are widely distributed across several different geographic regions. Which type of attack is the analyst most likely observing?
⚠ Common exam trap
A common mix-up: candidates confuse password spraying with credential stuffing: candidates see 'different usernames' and assume stolen credentials are being used, but the single reused password across all attempts is the key differentiator for password spraying.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying attack
The attack uses a single common password ('Spring2024!') against many different usernames, which is the hallmark of a password spraying attack. Unlike brute-force attacks that target one account with many passwords, password spraying avoids account lockout by trying one password across many accounts. The wide distribution of source IPs is consistent with a distributed password spraying campaign, often using botnets or proxies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-force attack
Why it's wrong here
A brute-force attack focuses the attacker's efforts on a single target account, systematically trying every possible password or a massive password list until one succeeds. This produces a telltale log pattern of many repeated authentication failures for the same username in a short window, which contrasts sharply with the observed logs showing one password attempted against many different usernames. Brute-force attacks are also more conspicuous and more likely to be stopped by lockout policies than password spraying.
When this WOULD be correct
A brute-force attack would be correct if the logs showed many failed attempts for a single username with different passwords, or if the question specified that the attacker is trying all possible passwords for one account.
- ✓
Password spraying attack
Why this is correct
Password spraying is an attack technique where a single common password (or a short list) is attempted against a large number of user accounts, typically once per account to avoid triggering account lockout policies. The observed authentication log pattern—many distinct usernames each tried with the same password—is the classic signature of this attack. Because each account sees only one or a few authentication failures, standard threshold-based detection often misses it until the analyst correlates across endpoints.
- ✗
Credential stuffing attack
Why it's wrong here
Credential stuffing relies on breached username/password pairs, so each authentication attempt uses a different, previously known password associated with that specific username. In the observed logs, the identical password is repeated across all attempts, which means the attacker is not using compromised pairs; they are leveraging password reuse across accounts. Credential stuffing would produce a log pattern where both usernames and passwords vary, often with the same password appearing only if the breach contained multiple accounts with the same password.
When this WOULD be correct
An analyst sees thousands of failed login attempts with various username/password combinations that match credentials from a known data breach. The attempts originate from multiple IPs and target a web application. This would indicate credential stuffing.
- ✗
Dictionary attack
Why it's wrong here
A dictionary attack typically targets a single user account by iterating through a list of common passwords—such as 'Password1' or '123456'—until one matches. The observed pattern is the inverse: a single password is tried against a wide range of usernames, indicating vertical rather than horizontal brute-forcing. Dictionary attacks are also more frequent in logs, but they concentrate their attempts on one account, which does not align with the multi-account failure pattern described.
When this WOULD be correct
A dictionary attack would be correct if logs showed many failed attempts using a list of common passwords (e.g., 'password123', 'admin', '123456') against a single username, with the same source IP.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Password spraying attackCorrect answer▾
Why this is correct
Password spraying is an attack technique where a single common password (or a short list) is attempted against a large number of user accounts, typically once per account to avoid triggering account lockout policies. The observed authentication log pattern—many distinct usernames each tried with the same password—is the classic signature of this attack. Because each account sees only one or a few authentication failures, standard threshold-based detection often misses it until the analyst correlates across endpoints.
✗Brute-force attackWrong answer — click to see why▾
Why this is wrong here
A brute-force attack typically targets a single username with many password attempts, but here many usernames are tried with one password, which is the opposite pattern.
★ When this WOULD be the correct answer
A brute-force attack would be correct if the logs showed many failed attempts for a single username with different passwords, or if the question specified that the attacker is trying all possible passwords for one account.
Why candidates choose this
Candidates may confuse 'many attempts' with brute-force, not realizing that the key distinction is the number of usernames versus passwords tried.
✗Credential stuffing attackWrong answer — click to see why▾
Why this is wrong here
Credential stuffing uses previously breached username/password pairs, not a single password with many usernames. The log shows the same password across different usernames, which is characteristic of password spraying, not credential stuffing.
★ When this WOULD be the correct answer
An analyst sees thousands of failed login attempts with various username/password combinations that match credentials from a known data breach. The attempts originate from multiple IPs and target a web application. This would indicate credential stuffing.
Why candidates choose this
Candidates may confuse password spraying with credential stuffing because both involve many usernames, but they fail to note that credential stuffing uses unique passwords per username from breach data, not a single password.
✗Dictionary attackWrong answer — click to see why▾
Why this is wrong here
A dictionary attack typically uses a list of common passwords against a single username, but here the same password is tried against many usernames, which is the opposite pattern.
★ When this WOULD be the correct answer
A dictionary attack would be correct if logs showed many failed attempts using a list of common passwords (e.g., 'password123', 'admin', '123456') against a single username, with the same source IP.
Why candidates choose this
Candidates may confuse 'dictionary attack' with any attack using a wordlist, not realizing that the defining characteristic is trying many passwords per username, not many usernames per password.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Social Engineering Attacks
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Password spraying
Password spraying is a type of brute-force attack where an attacker tries a few commonly used passwords against many different accounts to avoid account lockouts.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.