CEH Web Application and Injection Attacks Practice Question
After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying
Password spraying uses a small set of common passwords against many accounts or, as in this case, against a single account from multiple IPs to avoid lockout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Credential stuffing
Why it's wrong here
Credential stuffing involves using large lists of previously compromised username and password pairs, obtained from data breaches, to attempt logins across various unrelated online services. Attackers leverage the common user practice of reusing credentials, hoping that a combination successful on one site will also work on another. This attack relies on the *source* of the credentials being known valid pairs, rather than just arbitrary or common guesses, which isn't explicitly stated by 'repeated login attempts'.
- ✗
Brute force attack
Why it's wrong here
A traditional brute force attack systematically tries every possible password combination against a *single target account* until the correct one is found. This method typically involves a high volume of password attempts originating from a *limited number of source IP addresses*, making it highly susceptible to account lockout policies and IP-based blocking. The scenario's implication of 'different IPs' suggests a distributed approach, which deviates from the typical single-source characteristic of a classic brute force.
- ✓
Password spraying
Why this is correct
Password spraying is a sophisticated attack technique where a small number of very common passwords are systematically tried against a *large number of different user accounts* or a single account from *many different IP addresses*. This method is specifically designed to evade account lockout thresholds by distributing attempts across many targets or sources, preventing any single account or IP from exceeding the lockout limit. The 'repeated login attempts' observed in logs align perfectly with this strategy, as attackers aim to find weak passwords without triggering immediate detection.
- ✗
Dictionary attack
Why it's wrong here
A dictionary attack attempts to gain unauthorized access by trying a predefined list of words, phrases, and common character combinations as passwords against a target account. While it uses a wordlist, this attack typically involves a *larger set of potential passwords* than password spraying and is often directed at a *single user account* or a small set of accounts. Unlike spraying, which prioritizes avoiding lockouts by spreading attempts, a dictionary attack's primary focus is on the breadth of the wordlist against a specific target.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?
medium- A.Using a list of compromised credentials from a data breach
- B.Trying many passwords for a single account
- ✓ C.Trying a few common passwords against many accounts
- D.Using automated tools to bypass CAPTCHA
Why C: Password spraying uses a few common passwords against many accounts to avoid account lockout.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.