A SIEM correlates VPN logs and sees the same public IP make one failed login attempt against 56 different user accounts over 25 minutes. The usernames vary, but the password value appears to be the same in each attempt. Ten minutes later, one of those accounts authenticates successfully from the same IP, and no password-reset events are recorded. Which attack pattern is most likely?

A brute-force attack focused on a single account with repeated rapid guesses.

Brute force usually concentrates on one username and produces many failures for that same account rather than spreading attempts across many users.

A replay attack using captured authentication traffic from a previous session.

Replay attacks reuse intercepted credentials or tokens, which typically would not appear as many fresh failed password attempts across different accounts.

Credential stuffing using known breached username and password pairs.

Credential stuffing usually uses previously leaked valid pairs, while this scenario shows one repeated password being tested across many usernames.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Password spraying against multiple accounts with a shared password guess. — The pattern points to password spraying. Attackers intentionally keep the number of attempts per account low so they do not trigger lockouts or obvious brute-force alerts. The same password used across many usernames, followed by one successful login from the same source, is a strong indicator that the attacker is testing a common guess at scale. The account that succeeded should be treated as potentially compromised and investigated for MFA, token, and mailbox or VPN abuse. Why others are wrong: A brute-force attack would usually hammer one account with many guesses, not spread across dozens of users. Replay attacks reuse captured authentication material rather than generating a trail of password failures. Credential stuffing relies on leaked username/password combinations; this case instead suggests one shared password guess being sprayed across many accounts.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.