SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst receives an alert about a user account attempting to access multiple network shares in rapid succession within a short time frame. The analyst reviews the logs and sees that the IP address originates from the internal network, but the user is currently on leave. Which type of attack is most likely occurring?
⚠ Common exam trap
Many candidates confuse the rapid enumeration of network shares with a brute-force or credential-based attack, failing to recognize that the attacker is already authenticated and is simply mapping the network for further exploitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Internal reconnaissance
The behavior—an internal IP address rapidly querying multiple network shares—is characteristic of internal reconnaissance, where an attacker who has already gained a foothold maps out available resources. The user being on leave indicates the account is compromised, and the rapid succession of share access attempts is a classic sign of automated enumeration (e.g., using `net view` or SMB queries) rather than a direct credential attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pass-the-hash attack
Why it's wrong here
A pass-the-hash (PtH) attack specifically involves extracting an NTLM password hash from a compromised host and reusing it to authenticate to remote systems without knowing the plaintext password. The described scenario shows an authenticated user actively accessing multiple network shares, which is consistent with an authenticated session's token or Kerberos ticket, not the repeated replay of hashes to initiate new logons. PtH typically manifests as anomalous network logons (Event ID 4624 with Logon Type 3) across many hosts, whereas share enumeration is commonly performed with already-obtained credentials via normal SMB file access. The rapid share probing in the alert points to post-authentication discovery rather than the credential reuse phase.
When this WOULD be correct
A pass-the-hash attack would be correct if the question described an attacker using a stolen hash to authenticate to multiple systems or services without needing the plaintext password, such as in a lateral movement scenario after compromising a single host.
- ✗
Brute-force attack
Why it's wrong here
Brute-force attacks are fundamentally a pre-authentication credential-guessing technique, where an attacker repeatedly submits password candidates to an authentication service until one succeeds. In this alert, the account is already authenticated and has an established session, so the activity occurs after authentication. Furthermore, a brute-force attack would generate a spike of failed logon events (Event ID 4625), not the rapid enumeration of network shares via authenticated SMB queries. The absence of failed logins and the presence of active share access indicate the attacker has already moved beyond the credential-guessing stage.
When this WOULD be correct
A brute-force attack would be correct if the alert showed numerous failed login attempts against a single account or service from the same IP, indicating password guessing.
- ✗
Credential stuffing attack
Why it's wrong here
Credential stuffing relies on large sets of username/password pairs leaked from previous breaches and attempts them across different services to gain initial access. While this could theoretically compromise the account, the alert describes activity that occurs long after the initial logon, specifically the rapid access to multiple network shares—a hallmark of internal reconnaissance. Credential stuffing campaigns typically target authentication endpoints with high volume and often affect many accounts simultaneously, not just one authenticated user conducting SMB share enumeration. The observed behavior is consistent with an attacker who has already established access and is now mapping the environment for valuable data, not someone still trying to get in.
When this WOULD be correct
A security analyst sees multiple failed login attempts from various external IPs using username/password pairs known from a recent data breach. The correct answer would be credential stuffing, as the attacker is using stolen credentials to gain unauthorized access.
- ✓
Internal reconnaissance
Why this is correct
Internal reconnaissance involves an attacker who has already compromised a system and is now scanning internal resources to identify valuable data or further targets. The rapid access to multiple network shares aligns with this activity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Internal reconnaissanceCorrect answer▾
Why this is correct
Internal reconnaissance involves an attacker who has already compromised a system and is now scanning internal resources to identify valuable data or further targets. The rapid access to multiple network shares aligns with this activity.
✗Pass-the-hash attackWrong answer — click to see why▾
Why this is wrong here
Pass-the-hash attacks involve using captured password hashes to authenticate without knowing the plaintext password, but the alert describes rapid access to multiple shares, not authentication with a hash. The user is on leave, suggesting the account is compromised, but the behavior (reconnaissance) is more indicative of internal reconnaissance.
★ When this WOULD be the correct answer
A pass-the-hash attack would be correct if the question described an attacker using a stolen hash to authenticate to multiple systems or services without needing the plaintext password, such as in a lateral movement scenario after compromising a single host.
Why candidates choose this
Candidates may confuse any attack involving compromised credentials with pass-the-hash, especially if they recall that pass-the-hash can be used for lateral movement, but they overlook that the specific behavior (rapid share access) is reconnaissance, not authentication.
✗Brute-force attackWrong answer — click to see why▾
Why this is wrong here
A brute-force attack involves repeated login attempts with different passwords, but the alert describes rapid access to multiple network shares after authentication, not failed logins.
★ When this WOULD be the correct answer
A brute-force attack would be correct if the alert showed numerous failed login attempts against a single account or service from the same IP, indicating password guessing.
Why candidates choose this
Candidates may confuse 'rapid succession' with brute-force attempts, not realizing the user is already authenticated and the activity is post-login reconnaissance.
✗Credential stuffing attackWrong answer — click to see why▾
Why this is wrong here
Credential stuffing uses previously compromised credentials from other breaches, but the question states the user is on leave and the IP is internal, suggesting the attacker already has valid credentials and is performing reconnaissance, not testing stolen credentials.
★ When this WOULD be the correct answer
A security analyst sees multiple failed login attempts from various external IPs using username/password pairs known from a recent data breach. The correct answer would be credential stuffing, as the attacker is using stolen credentials to gain unauthorized access.
Why candidates choose this
Candidates may confuse rapid access attempts with credential testing, but credential stuffing typically involves many different accounts, not a single user's account accessing multiple shares.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
SMB
SMB is a network file-sharing protocol that allows applications to read, write, and request services from server programs in a computer network.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.