SY0-701 Security Operations Practice Question
A SIEM correlates VPN authentication logs and sees 14 different user accounts receive one failed login attempt each from the same source IP during a 5-minute window. A few minutes later, one of those accounts successfully authenticates from that same IP. Which attack is most likely?
⚠ Common exam trap
It's easy for candidates to confuse password spraying with brute-force attacks, failing to recognize that the key differentiator is the number of accounts targeted versus the number of passwords attempted per account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying using a common password against many accounts.
The SIEM observed 14 different user accounts each receiving a single failed login attempt from the same source IP within a 5-minute window, followed by one account successfully authenticating. This pattern is characteristic of password spraying, where an attacker tries a common password (e.g., 'Password123') against many accounts to avoid triggering account lockouts, then leverages a successful guess. The single failure per account avoids the threshold for brute-force detection, and the eventual success confirms a guessed credential.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-force attack against a single account using many passwords.
Why it's wrong here
A classic brute-force attack would focus on a single username and generate an overwhelming number of failed password attempts for that one account, often locking it out and leaving an obvious trail. The SIEM pattern of 14 different accounts indicates each account was hit only once or twice, which is the inverse of brute-force behavior. In practice, VPN lockout policies make such an attack noisy and short-lived, so this distributed pattern is not consistent with a brute-force attempt.
- ✓
Password spraying using a common password against many accounts.
Why this is correct
Password spraying is a low-and-slow technique that tests one common password (for example, 'Autumn2024!') against a broad list of usernames, keeping attempts per account below threshold to trigger no lockout. The correlation of 14 distinct VPN authentication failures followed by one success is exactly the signature of a spray, where the attacker cycles through accounts with a single guess each round. This method evades per-account brute-force detection and relies on weak password reuse across the environment.
- ✗
Replay attack using previously captured authentication traffic.
Why it's wrong here
A replay attack, by definition, involves capturing a legitimate authentication exchange—such as a Kerberos ticket, a session token, or a signed RADIUS packet—and retransmitting it to impersonate the user. That would result in successful authentication events using the replayed credential, not a sequence of failed login attempts across multiple separate accounts. Moreover, replay attacks require prior network sniffing or access to captured traffic; nothing in the SIEM log indicates such activity, and VPN encryption would typically invalidate any replayed session after time-based tokens expire.
- ✗
ARP poisoning used to intercept local network traffic.
Why it's wrong here
ARP poisoning is a layer 2 man-in-the-middle technique that manipulates a local Ethernet ARP table to intercept traffic between two hosts on the same subnet. It does not and cannot generate VPN authentication log events, because VPN authentication is an end-to-end cryptographic handshake that occurs over an encrypted tunnel, independent of L2 interception. The observed pattern—14 distinct accounts failing and one succeeding—points to a credential attack against the authentication service, not a network interception anomaly.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Password spraying
Password spraying is a type of brute-force attack where an attacker tries a few commonly used passwords against many different accounts to avoid account lockouts.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.