Password Spraying Attack vs Brute Force Detection
A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?
Quick Answer
The answer is a password spraying attack using common passwords across many accounts. This is the correct explanation because the log pattern shows 68 distinct user accounts each suffering a single failed login from the same source IP, with no lockouts triggered, followed by one successful authentication—a classic signature of password spraying. Unlike brute force detection, which would flag multiple rapid attempts against a single account, password spraying deliberately spreads one or two common passwords across many accounts to evade lockout thresholds, typically set at three to five failures per account. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish between attack types based on log patterns; a common trap is confusing it with a brute force attack, which would show repeated failures on one account. Memory tip: think “spray one password, many accounts” versus “brute force one account, many passwords.”
⚠ Common exam trap
CompTIA often tests the distinction between brute-force (many passwords, one account) and password spraying (one password, many accounts), and the trap here is that candidates see 'failed login attempts' and immediately assume brute-force without noticing the unique pattern of one failure per account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A password spraying attack using common passwords across many accounts.
The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A brute-force attack against a single account using many password guesses.
Why it's wrong here
Brute force targets one account with many guesses; here 68 different accounts each failed once, indicating password spraying against many accounts to avoid lockout thresholds. It is tempting because a burst of failed logins from one source is the classic brute-force signature, and brute force would be correct if the failures repeated against a single username.
- ✓
A password spraying attack using common passwords across many accounts.
Why this is correct
Password spraying tries a few common passwords across many accounts to evade lockout thresholds. The 68 single failures from one IP, with no lockouts and one eventual success, match that pattern rather than brute force against a single account.
- ✗
A replay attack using captured authentication traffic.
Why it's wrong here
Replay attacks reuse captured authentication traffic, typically a session token or hash, so they do not generate 68 distinct failed logins across separate accounts. It is tempting because valid credentials appearing from an unexpected IP suggests intercepted material, and replay would fit a single captured session being resent.
- ✗
A successful SSO federation event after a directory sync delay.
Why it's wrong here
SSO federation after a directory sync delay would not produce 68 separate failed authentications from one IP before a single success. It is tempting because sync delays genuinely cause transient login failures, and that explanation would fit a brief cluster of failures across accounts followed by normal access.
Go deeper
Related to this question
Learn chapter
UEBA — User and Entity Behavior Analytics
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Password spraying
Password spraying is a type of brute-force attack where an attacker tries a few commonly used passwords against many different accounts to avoid account lockouts.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,030 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing authentication logs and observes multiple failed login attempts for a single user account occurring within a short timeframe, followed by a successful login from an IP address located in a country where the user has never traveled. The failed attempts originate from various IP addresses and use different passwords. Which type of attack has most likely occurred?
medium- ✓ A.Brute-force attack
- B.Credential stuffing
- C.Password spraying
- D.Dictionary attack
Why A: (Brute-force attack) because the log shows multiple failed login attempts from various IP addresses using different passwords, followed by a successful login from an unfamiliar country. This pattern indicates a distributed brute-force attack where the attacker systematically tries many passwords against a single account, often using a botnet or proxy rotation to evade IP-based rate limiting. The successful login from a foreign IP confirms the attacker eventually guessed the correct password.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.