CEH Enumeration and System Hacking Practice Question
An analyst observes repeated failed login attempts to a Windows server from an internal IP, followed by a successful login using the account 'admin' from the same IP. The analyst checks the Security log and finds Event ID 4624 with Logon Type 3. What type of attack is MOST likely occurring?
⚠ Common exam trap
The trap here is that candidates see 'successful login' and 'Event ID 4624' and incorrectly assume a pass-the-hash or relay attack, but the presence of repeated failed attempts before success is the key indicator of a dictionary attack, not a credential theft technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dictionary attack on the admin account
Event ID 4624 with Logon Type 3 indicates a network logon (typically SMB or other network resource access). The sequence of repeated failed attempts followed by a successful login from the same internal IP strongly suggests a dictionary (brute-force) attack against the 'admin' account. The attacker systematically tried passwords until one succeeded, which is the hallmark of a dictionary attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SMB relay attack
Why it's wrong here
An SMB relay attack involves an attacker intercepting legitimate SMB authentication requests and then relaying them to another server to authenticate as the victim. This technique does not involve guessing passwords or generating multiple failed login attempts. Instead, it leverages valid authentication material to gain access, often leading to session hijacking or privilege escalation without any brute-force activity.
- ✗
Kerberos golden ticket attack
Why it's wrong here
A Kerberos golden ticket attack is a post-exploitation technique where an attacker, having compromised the KRBTGT account hash, forges a Kerberos Ticket Granting Ticket (TGT). This forged ticket grants arbitrary privileges and access to any resource within the domain, bypassing all authentication mechanisms. Since it relies on pre-existing compromise and ticket forgery, it completely circumvents the need for any login attempts, failed or otherwise, to gain access.
- ✗
Pass-the-hash attack
Why it's wrong here
A pass-the-hash (PtH) attack allows an attacker to authenticate to a remote server or service using a user's NTLM hash directly, without needing to crack the hash to obtain the plaintext password. This method bypasses the traditional password authentication process entirely by reusing the cryptographic hash. Consequently, PtH attacks do not generate failed login attempts, as they leverage valid, albeit stolen, authentication material to establish a session.
- ✓
Dictionary attack on the admin account
Why this is correct
A dictionary attack systematically attempts to log in using a predefined list of common passwords, often targeting specific user accounts like 'admin'. The observation of repeated failed login attempts to a Windows system is a classic indicator of such an attack in progress. Each incorrect password guess contributes to the failed attempt count, making this attack type directly align with the described scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.