CHFI OS and Network Forensics Practice Question
A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?
⚠ Common exam trap
EC-Council often tests the distinction between a brute-force attack (many failed logons from varied IPs) and a pass-the-hash attack (which uses a valid hash and does not generate failed logon events), leading candidates to confuse the two when they see Event ID 4625.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute‑force attack
Event ID 4625 indicates a failed logon attempt. A sudden spike from random, external source IPs is characteristic of a brute-force attack, where an attacker systematically tries many username/password combinations against the domain controller. This pattern does not match the stealthier or more targeted nature of the other attack types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pass‑the‑hash attack
Why it's wrong here
A pass-the-hash attack relies on a stolen NTLM or LanMan hash used directly in challenge-response authentication, so the attacker never needs to guess a password. If the hash is valid, the logon succeeds and generates a 4624 success event rather than a wave of 4625 failures; failed 4625 events would appear only when the hash is invalid or the target account is locked. The multi-IP failed-logon spike therefore fits credential guessing, not hash replay.
- ✗
Kerberos ticket forgery (Golden Ticket)
Why it's wrong here
A Golden Ticket is a forged Kerberos TGT encrypted/signed with the KRBTGT account hash, giving the attacker domain-wide impersonation without any password guessing. Kerberos pre-authentication succeeds because the ticket is cryptographically valid, so the resulting activity shows TGT issuance or service ticket requests (events 4768/4769), not repeated 4625 failed-logon failures. A burst of failed logon events indicates failed pre-authentication or password validation, which ticket forgery bypasses entirely.
- ✗
Insider threat with compromised credentials
Why it's wrong here
An insider using compromised credentials would likely authenticate from a known corporate workstation or a small set of internal IPs consistent with their normal behavior, not from randomized external sources. Their goal is to avoid detection, so deliberately generating thousands of failed logon events would be counterproductive; a legitimate credential or a known password would work on the first attempt. A distributed wave of failed logons is far more consistent with an external automated guessing campaign.
- ✓
Brute‑force attack
Why this is correct
Each 4625 event explicitly records an authentication failure with logon type, source IP, and username, so a sudden spike from many different source addresses targeting the same accounts is the hallmark of a distributed password-guessing attack. The attacker submits candidate passwords over RDP, SMB, or VPN until one succeeds, which is exactly why the failed-logon count spikes before eventual access. The varied external IPs and volume distinguish this from credential misuse or ticket-forging attacks.
Visual reference
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.