A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

A brute-force attack against a single account using many password guesses.

Brute force usually targets one account repeatedly with many guesses, rather than spreading a small number of attempts across many users.

A replay attack using captured authentication traffic.

A replay attack would typically reuse an intercepted token or credential pair, not produce many scattered failed password attempts first.

A successful SSO federation event after a directory sync delay.

A normal federation event would not usually generate repeated failures from the same source IP across many unrelated accounts.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A password spraying attack using common passwords across many accounts. — The pattern strongly indicates password spraying. Attackers commonly use one or a few likely passwords across many accounts to avoid triggering account lockouts that would occur with repeated guesses against one user. The fact that a later successful login came from the same source IP reinforces the likelihood that one of the sprayed passwords matched an account. This is a classic SIEM correlation use case because the raw failures alone can look harmless until viewed across multiple users and time. Why others are wrong: Brute force focuses on one account and usually creates many failures quickly. Replay attacks reuse captured authentication data, which would not create this specific spread of failures. A routine SSO or directory sync event would not present as repeated failed logins from the same IP across dozens of accounts. The key clue is low-and-slow failures distributed across many users, followed by one success.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.