SY0-701 Security Operations Practice Question
A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?
⚠ Common exam trap
A common mix-up: candidates confuse password spraying with brute-force attacks, failing to recognize that the key differentiator is the single password used against multiple accounts versus multiple passwords against a single account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying against multiple accounts with a shared password guess.
The SIEM logs show the same public IP attempting to authenticate with 56 different usernames using the same password. This is the hallmark of a password spraying attack, where an attacker tries a single common password against many accounts to avoid account lockout policies. The subsequent successful authentication from the same IP, without a password reset, confirms the guessed password was valid for one account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Password spraying against multiple accounts with a shared password guess.
Why this is correct
This pattern matches password spraying because the attacker tries one common password across many usernames to avoid lockouts and reduce noisy failures. The same source IP, low failure count per account, and eventual success on one account are classic clues. Analysts should treat the successful login as potentially compromised and review related authentication, MFA, and session activity immediately.
- ✗
A brute-force attack focused on a single account with repeated rapid guesses.
Why it's wrong here
In a true brute-force attack, the adversary iterates through a large password list against one target username, generating a high volume of failed authentication events for that single account. This signature contrasts with password spraying, where each account sees only a few failures, because the same guessed password is tried across many usernames to avoid triggering lockout thresholds. Since the SIEM correlation shows the same public IP testing one shared password across a wide set of accounts rather than hammering a single user, the event pattern does not match brute force.
- ✗
A replay attack using captured authentication traffic from a previous session.
Why it's wrong here
A replay attack involves capturing a valid authentication exchange, such as a Kerberos ticket, NTLM hash, or session cookie, and resending it to trick the service into accepting it as a fresh login. The SIEM would generally see a successful reuse of that captured artifact, not a burst of failed password attempts distributed across many distinct usernames from one source IP. Moreover, the observed events show the attacker testing a password against multiple accounts, which requires interactive guessing rather than the passive replay of prior traffic, so this explanation does not account for the scattered failures that precede the eventual success.
- ✗
Credential stuffing using known breached username and password pairs.
Why it's wrong here
Credential stuffing relies on username/password pairs obtained from prior data breaches, so each authentication attempt uses a unique credential that is expected to be valid for that specific user. In contrast, the SIEM evidence indicates the same single password value being applied systematically across many accounts, which is the hallmark of password spraying and not of credential stuffing. Additionally, credential stuffing typically produces one failure per username for each breached pair tried, whereas the observed pattern demonstrates a shared guess reused across a broad account set, making the two attack vectors distinguishable by their password reuse characteristics.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.