A security analyst is reviewing authentication logs from a corporate web application. The logs show that over a span of two hours, a single external IP address attempted to log in with 500 different usernames, each using the same password 'Spring2024!'. Only a few of these attempts succeeded. Which type of attack is most likely being observed?

Brute force attack

A brute force attack typically targets a single username with many password attempts. The logs show many usernames with one password, not one username with many passwords.

Credential stuffing attack

Credential stuffing uses known username and password pairs from previous breaches. The logs show the same password for different usernames, not unique compromised credentials.

Dictionary attack

A dictionary attack is a type of brute force that tries multiple passwords from a wordlist against a single username. This scenario uses one password against many usernames, ruling out a dictionary attack.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Password spraying attack — This scenario describes a password spraying attack, where an attacker tries a commonly used password against many accounts to avoid account lockout policies. The key indicator is the use of one password across many usernames. A brute force attack would attempt many passwords against a single username. Credential stuffing uses previously compromised username/password pairs. A dictionary attack is a form of brute force that uses a list of likely passwords against a single target account.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.