SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst reviews authentication logs and discovers hundreds of failed login attempts from a single external IP address within a five-minute window. All attempts target the same username 'jsmith' but use different passwords. Which type of password attack does this pattern most likely indicate?
⚠ Common exam trap
Many candidates confuse brute force with password spraying: candidates often pick password spraying because they see 'different passwords,' but the key differentiator is the single target username versus multiple usernames, which defines the attack vector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute force
The pattern of hundreds of failed login attempts from a single external IP address targeting the same username 'jsmith' with different passwords is characteristic of a brute force attack. In a brute force attack, the attacker systematically tries many password guesses against a single account to eventually find the correct credential. This contrasts with password spraying, where a few common passwords are tried against many usernames, and credential stuffing, which uses previously compromised username/password pairs from other breaches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password spraying
Why it's wrong here
Password spraying inverts the brute force approach by trying one or a few common passwords, such as 'P@ssw0rd' or 'Winter2024', against a large list of usernames. Its goal is to stay below each account's lockout threshold and avoid triggering velocity alerts, so the authentication logs would show a single password attempted across many identities. The scenario under review shows many passwords for one username, which is the opposite pattern and therefore not password spraying.
When this WOULD be correct
A question describing failed login attempts from a single IP address targeting multiple different usernames with a small set of common passwords (e.g., 'Password123', 'Welcome1') over a short period would make password spraying the correct answer.
- ✓
Brute force
Why this is correct
A brute force attack programmatically enumerates a large number of possible passwords, often from an exhaustive character set or massive wordlist, and submits them sequentially against one known username. Observing hundreds of distinct password attempts for the same target account is the signature of this technique, especially when the guesses are not sourced from a prior breach. Unlike password spraying, which would distribute guesses across accounts, this log pattern concentrates attempts on a single credential pair.
- ✗
Credential stuffing
Why it's wrong here
Credential stuffing relies on stolen username/password pairs from a previous data breach, feeding those exact combinations into login endpoints at scale. In the logs, successful or failed attempts would appear as one specific known password per account, not hundreds of different guesses for a single account. The observed diversity of attempted passwords indicates an active guessing process rather than replay of compromised static credentials.
When this WOULD be correct
A question describes a security analyst seeing many failed logins from different IPs using the same username/password pairs that match known breach data, targeting multiple accounts.
- ✗
Dictionary attack
Why it's wrong here
Incorrect. While a dictionary attack also uses a list of likely passwords, it is a subset of brute force. The broader category 'brute force' is more accurate given the large volume and systematic nature of the attempts.
When this WOULD be correct
A dictionary attack would be correct if the question described an attacker using a wordlist of common passwords (e.g., 'password123', 'admin') against a single username, with attempts showing repeated passwords from the list rather than sequential or random variations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Brute forceCorrect answer▾
Why this is correct
A brute force attack programmatically enumerates a large number of possible passwords, often from an exhaustive character set or massive wordlist, and submits them sequentially against one known username. Observing hundreds of distinct password attempts for the same target account is the signature of this technique, especially when the guesses are not sourced from a prior breach. Unlike password spraying, which would distribute guesses across accounts, this log pattern concentrates attempts on a single credential pair.
✗Password sprayingWrong answer — click to see why▾
Why this is wrong here
Password spraying involves trying a few common passwords against many usernames, but this question describes many passwords against a single username, which is the opposite pattern.
★ When this WOULD be the correct answer
A question describing failed login attempts from a single IP address targeting multiple different usernames with a small set of common passwords (e.g., 'Password123', 'Welcome1') over a short period would make password spraying the correct answer.
Why candidates choose this
Candidates may confuse the terms 'password spraying' and 'brute force' because both involve multiple login attempts, but they differ in the target pattern (many users vs. one user).
✗Credential stuffingWrong answer — click to see why▾
Why this is wrong here
Credential stuffing uses previously breached username/password pairs, but this attack uses many different passwords for a single username, not known credentials.
★ When this WOULD be the correct answer
A question describes a security analyst seeing many failed logins from different IPs using the same username/password pairs that match known breach data, targeting multiple accounts.
Why candidates choose this
Candidates may confuse credential stuffing with brute force because both involve many login attempts, but credential stuffing relies on leaked credentials, not guessing passwords.
✗Dictionary attackWrong answer — click to see why▾
Why this is wrong here
A dictionary attack uses a list of common passwords against a single username, but the question states 'different passwords' without indicating they come from a predefined list; the sheer volume of attempts from one IP targeting one user in a short time frame is characteristic of a brute-force attack, not a dictionary attack.
★ When this WOULD be the correct answer
A dictionary attack would be correct if the question described an attacker using a wordlist of common passwords (e.g., 'password123', 'admin') against a single username, with attempts showing repeated passwords from the list rather than sequential or random variations.
Why candidates choose this
Candidates may confuse 'dictionary attack' with any attack using a list of passwords, but fail to recognize that brute force systematically tries all combinations, while dictionary attacks rely on a predefined list of likely passwords.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Password Attacks
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Password spraying
Password spraying is a type of brute-force attack where an attacker tries a few commonly used passwords against many different accounts to avoid account lockouts.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.