CHFI OS and Network Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Password spraying attack

  Why this is correct

  Password spraying is a low-and-slow attack in which an adversary chooses a handful of common passwords and tries them individually across many user accounts from a single source IP. In Windows Security logs this manifests as multiple Event ID 4625 failed-logon events with different account names but the same source workstation/IP and a common failure code such as 0xC000006D, often within a short window. Because each account is hit only once or twice, the total event volume stays low, evading threshold-based brute-force detection while still matching the observed pattern of many usernames from the same source.

• ✗

  Brute-force attack on a single account

  Why it's wrong here

  A classic brute-force attack concentrates a high volume of password guesses against a single account name, producing many Event ID 4625 failures that all reference the same username while the source IP and Logon Type remain constant. The signature is a dense series of sequential failures for one account, often ending with a successful Event ID 4624 once the correct password is found. The evidence described—multiple distinct usernames rather than repeated failures for one user—contradicts the single-target nature of a brute-force attack.

• ✗

  Pass-the-hash attack

  Why it's wrong here

  Pass-the-hash does not involve guessing or spraying passwords; it uses a captured or dumped NTLM hash to authenticate as an already-known user, so the attacker has a valid credential. Successful pass-the-hash attempts generate Event ID 4624 successful-logon events with Logon Type 3 (network) or 9 (new credentials), not Event ID 4625 failures. The absence of corresponding successful logons and the presence of many failed attempts for many accounts rule out pass-the-hash as the underlying cause of these security events.

• ✗

  Kerberoasting attack

  Why it's wrong here

  Kerberoasting is a post-exploitation technique that targets domain service accounts by requesting TGS tickets for SPN-linked accounts through standard Kerberos traffic, then cracking the ticket-encrypted section offline. These legitimate AS-REQ/TGS-REQ requests do not generate Event ID 4625 failed-logon events; instead, they appear as Event ID 4769 (Kerberos service ticket operations) in the Windows security log. Since the observed evidence consists entirely of failed logons, Kerberoasting does not fit the pattern.

Go deeper

Related to this question