GCIH Attacking Passwords Practice Question
During an incident response engagement at a financial firm, you are reviewing authentication logs on a Windows Server 2019 domain controller. You notice a series of failed logon attempts with Event ID 4625, all originating from a single source IP, using a list of 500 common usernames but only one password attempt per username. The attempts occur over a period of 30 minutes. Which type of password attack is most likely being executed?
⚠ Common exam trap
A common mix-up: candidates confuse password spraying with brute-force, but spraying uses one password against many accounts, while brute-force uses many passwords against one account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password spraying
The pattern of many usernames with a single password attempt each is characteristic of password spraying. This technique avoids lockout by keeping failed attempts per account low while testing a common password across many accounts. Credential stuffing uses breached pairs, brute-force targets one account, and rainbow tables are offline. Thus, password spraying is the correct identification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-force attack
Why it's wrong here
A brute-force attack systematically tries many passwords against a single account until successful. The log shows many usernames but only one password attempt per user, which is the opposite pattern. Brute-force would generate a high volume of failed attempts for one account, likely triggering lockout.
- ✓
Password spraying
Why this is correct
Password spraying uses a small number of common passwords against many accounts to avoid lockout thresholds. Here, 500 usernames with a single password attempt each matches this pattern perfectly. It is a low-and-slow approach that evades account lockout policies, making it the most likely attack based on the log evidence.
- ✗
Credential stuffing
Why it's wrong here
Credential stuffing relies on previously breached username/password pairs from other sites. The scenario describes using a list of common usernames, not known compromised credentials, and only one password per username. This does not align with credential stuffing, which would typically show varied passwords from a breach corpus.
- ✗
Rainbow table attack
Why it's wrong here
Rainbow tables are used offline against captured password hashes, not for online authentication attempts. They require possession of the hash and significant precomputation. The scenario involves live logon attempts against a domain controller, which is an online attack, so rainbow tables are not applicable here.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.