SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The pattern is consistent with a password spraying attack.

  Why this is correct

  Password spraying is a low-and-slow attack where an adversary tries a small set of common passwords against many accounts, usually one attempt per account per pass to avoid triggering lockout policies. The SIEM sequence of repeated single failed logins across different users from the same source IP over 25 minutes matches this pattern exactly: no individual account is hammered, yet the cumulative authentication attempt volume is high. The eventual successful login indicates that at least one account was using a weak, predictable password that the attacker had guessed in the spraying cycle.

• ✗

  The attacker is performing a brute-force attack against one account.

  Why it's wrong here

  A brute-force attack against a single account would manifest as a rapid burst of many authentication failures for the same username as the attacker cycles through password variations or dictionary words. The reported SIEM data shows failures spread across numerous user accounts rather than concentrated on one, which is the opposite of the single-account brute-force signature. Additionally, brute-force attempts typically trip account lockout thresholds after a handful of failures, whereas the observed one-failure-per-account distribution deliberately avoids that control, further ruling out this explanation.

• ✗

  The activity is most likely credential stuffing with multiple known password pairs.

  Why it's wrong here

  Credential stuffing involves replaying large sets of leaked username/password pairs, often producing a mix of successes and failures across many accounts as the attacker iterates through stolen credential combinations. The SIEM shows a uniform single failed attempt per account, which would be atypical for credential stuffing because the attacker already has candidate credentials for each target and would not need to test a generic password against every user. Also, credential stuffing frequently yields multiple successful logins due to widespread password reuse, but this sequence contains only a single success, making this explanation far less plausible.

• ✓

  The successful account is likely compromised and being used for persistence or mailbox abuse.

  Why this is correct

  The post-authentication behavior—creating a mailbox forwarding rule and performing bulk access to messages—is a strong indicator of account takeover and malicious persistence. A forwarding rule allows the attacker to silently exfiltrate all future emails, while bulk message access enables data theft or reconnaissance, neither of which is consistent with a mere authentication scan. Therefore, the successful account should be considered fully compromised and treated as a priority for incident response, including revocation of credentials, removal of forwarding rules, and review of mailbox access logs.

• ✗

  The events primarily indicate a denial-of-service attack against the mail system.

  Why it's wrong here

  A denial-of-service attack is designed to overwhelm a service by exhausting resources or saturating bandwidth, typically through network floods, malformed requests, or volume-based email bombing, not through low-and-slow authentication attempts. The SIEM sequence records discrete authentication failures and a single mailbox access event, which lacks the sustained request rate or resource consumption necessary to degrade mail system availability. Misclassifying this activity as DoS would overlook the actual credential-based threat and delay the necessary containment steps for the compromised account.

Go deeper

Related to this question