Password Spraying Attack vs Brute Force Detection
A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?
Quick Answer
The answer is a password spraying attack using common passwords across many accounts. This is the correct explanation because the log pattern shows 68 distinct user accounts each suffering a single failed login from the same source IP, with no lockouts triggered, followed by one successful authentication—a classic signature of password spraying. Unlike brute force detection, which would flag multiple rapid attempts against a single account, password spraying deliberately spreads one or two common passwords across many accounts to evade lockout thresholds, typically set at three to five failures per account. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish between attack types based on log patterns; a common trap is confusing it with a brute force attack, which would show repeated failures on one account. Memory tip: think “spray one password, many accounts” versus “brute force one account, many passwords.”
⚠ Common exam trap
CompTIA often tests the distinction between brute-force (many passwords, one account) and password spraying (one password, many accounts), and the trap here is that candidates see 'failed login attempts' and immediately assume brute-force without noticing the unique pattern of one failure per account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A password spraying attack using common passwords across many accounts.
The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A brute-force attack against a single account using many password guesses.
Why it's wrong here
Brute force usually targets one account repeatedly with many guesses, rather than spreading a small number of attempts across many users.
- ✓
A password spraying attack using common passwords across many accounts.
Why this is correct
This pattern matches password spraying because the attacker tests a small number of common guesses against many accounts to avoid lockouts.
- ✗
A replay attack using captured authentication traffic.
Why it's wrong here
A replay attack would typically reuse an intercepted token or credential pair, not produce many scattered failed password attempts first.
- ✗
A successful SSO federation event after a directory sync delay.
Why it's wrong here
A normal federation event would not usually generate repeated failures from the same source IP across many unrelated accounts.
Go deeper
Related to this question
Learn chapter
Log Monitoring and SIEM
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Password spraying
Password spraying is a type of brute-force attack where an attacker tries a few commonly used passwords against many different accounts to avoid account lockouts.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?
medium- ✓ A.Brute-force attack
- B.Credential stuffing
- C.Password spraying
- D.Dictionary attack
Why A: (Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.