How to Distinguish Password Spraying from Brute Force Attacks?
A security analyst is reviewing firewall logs and notices repeated connection attempts from a single external IP address to multiple internal IP addresses on TCP port 22 (SSH). Each attempt uses a different username but the same password: 'Spring2024!'. The attempts occur sporadically over a 12-hour period. Which type of attack is most likely being observed?
Quick Answer
The answer is a password spraying attack. This is correct because the attacker used a single common password, 'Spring2024!', against multiple usernames across different internal IP addresses, spreading the attempts sporadically over 12 hours to avoid triggering account lockout thresholds. In contrast, a brute force attack would focus many passwords against a single account in rapid succession. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish password spraying from brute force attacks by analyzing log patterns—specifically, the ratio of usernames to passwords and the timing of attempts. A common trap is confusing password spraying with a dictionary attack, but remember that dictionary attacks try many passwords against one user, while spraying tries one password against many users. For a quick memory tip: think "one password, many users" for spraying, versus "many passwords, one user" for brute force.
⚠ Common exam trap
Many exam-takers confuse 'multiple passwords against one user' (brute-force/dictionary) with 'one password against multiple users' (password spraying), especially when the scenario mentions 'different username' and 'same password' — a classic sign of a spraying attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying attack
This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against multiple usernames across different internal IP addresses, attempting to avoid account lockout by spreading attempts over time and targets. Unlike brute-force or dictionary attacks that focus many passwords against a single account, password spraying targets many accounts with a few weak passwords, making it harder to detect via failed login thresholds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-force attack
Why it's wrong here
Incorrect. A brute-force attack typically tries many different passwords against a single username to guess the correct one. The scenario uses a single password across multiple usernames, which is not characteristic of brute-force.
When this WOULD be correct
A brute-force attack would be correct if the logs showed repeated attempts with many different passwords against a single username, such as an attacker trying thousands of passwords on one account.
- ✗
Dictionary attack
Why it's wrong here
Incorrect. A dictionary attack uses a list of common passwords against a single account. Here, the attacker uses the same password repeatedly but targets many different accounts, which is not a dictionary attack.
When this WOULD be correct
A dictionary attack would be correct if the logs showed multiple connection attempts from a single external IP to a single internal IP on TCP port 22, each attempt using a different password from a predefined list (e.g., common passwords) against the same username.
- ✓
Password spraying attack
Why this is correct
Correct. Password spraying involves an attacker trying a small number of commonly used passwords against many different accounts to avoid lockout and evade detection. The use of a single password against many usernames exactly matches this technique.
- ✗
Man-in-the-middle attack
Why it's wrong here
Incorrect. A man-in-the-middle attack involves an attacker intercepting and potentially altering communications between two parties. The log entries show direct connection attempts, not intercepted traffic.
When this WOULD be correct
A security analyst notices that after a user connects to a corporate webmail portal, subsequent traffic from that user's machine is redirected through an attacker's proxy, capturing credentials. This would indicate a man-in-the-middle attack, where the attacker intercepts and relays communications.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Password spraying attackCorrect answer▾
Why this is correct
Correct. Password spraying involves an attacker trying a small number of commonly used passwords against many different accounts to avoid lockout and evade detection. The use of a single password against many usernames exactly matches this technique.
✗Brute-force attackWrong answer — click to see why▾
Why this is wrong here
A brute-force attack typically involves trying many passwords for a single username, but here the same password is used across multiple usernames, which is characteristic of password spraying.
★ When this WOULD be the correct answer
A brute-force attack would be correct if the logs showed repeated attempts with many different passwords against a single username, such as an attacker trying thousands of passwords on one account.
Why candidates choose this
Candidates may confuse password spraying with brute-force because both involve repeated login attempts, but they fail to notice that the attack uses a single password across many usernames rather than many passwords on one username.
✗Dictionary attackWrong answer — click to see why▾
Why this is wrong here
The attack uses the same password for multiple usernames, which is characteristic of password spraying, not dictionary attacks. A dictionary attack would involve trying many passwords against a single username, not a single password against many usernames.
★ When this WOULD be the correct answer
A dictionary attack would be correct if the logs showed multiple connection attempts from a single external IP to a single internal IP on TCP port 22, each attempt using a different password from a predefined list (e.g., common passwords) against the same username.
Why candidates choose this
Candidates may confuse password spraying with dictionary attacks because both involve using lists of passwords, but they differ in the target: dictionary attacks focus on one user with many passwords, while password spraying uses one password against many users.
✗Man-in-the-middle attackWrong answer — click to see why▾
Why this is wrong here
A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, not repeated login attempts from a single external IP to multiple internal IPs. The observed pattern of systematic password guessing across many accounts does not fit MITM.
★ When this WOULD be the correct answer
A security analyst notices that after a user connects to a corporate webmail portal, subsequent traffic from that user's machine is redirected through an attacker's proxy, capturing credentials. This would indicate a man-in-the-middle attack, where the attacker intercepts and relays communications.
Why candidates choose this
Candidates may think that using the same password across multiple accounts implies credential interception, but the active, repeated attempts from an external IP indicate a direct password guessing attack, not passive interception.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?
medium- A.Immediately block the IP address at the perimeter firewall.
- ✓ B.Investigate whether any of the attempted accounts correspond to actual domain users.
- C.Run a full antivirus scan on the domain controller.
- D.Notify the company's legal department for law enforcement involvement.
Why B: The analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.
Variation 2. A security operations analyst is tuning a SIEM correlation rule designed to detect brute-force password attacks against domain user accounts. The current rule generates an alert when a single user account has more than 10 failed logon attempts within a 5-minute window. The SOC team is overwhelmed by thousands of alerts each day, the vast majority of which are triggered by legitimate users who accidentally mistype their passwords. Which of the following modifications to the rule would most effectively reduce false positives while still detecting actual brute-force attacks?
medium- ✓ A.Increase the failed attempt threshold to 20 attempts within the same 5-minute window.
- B.Modify the rule to trigger only when the failed attempts originate from multiple distinct source IP addresses.
- C.Modify the rule to trigger only when the failed attempts are against multiple distinct user accounts.
- D.Add an exception to suppress alerts for any user account that has a valid password reset request within the same time period.
Why A: Increasing the failed attempt threshold to 20 attempts within the same 5-minute window reduces false positives from legitimate users while still detecting brute-force attacks, which typically produce many more failures in a short period. Option B would suppress all single-source brute-force attacks, creating significant false negatives.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.