mediumMultiple ChoiceObjective-mapped
Detecting Brute-Force Attacks from Windows Event Logs
Exhibit
Refer to the exhibit. Exhibit: Event Log Entry: Time: 2023-10-05 14:23:17 Event ID: 4625 Source: Security User: SYSTEM Logon Type: 3 Account Name: jdoe Account Domain: CORP Failure Reason: Unknown user name or bad password. Workstation Name: WS-001 IP Address: 192.168.1.50 Event Log Entry: Time: 2023-10-05 14:24:05 Event ID: 4624 Source: Security User: SYSTEM Logon Type: 3 Account Name: jdoe Account Domain: CORP Workstation Name: WS-001 IP Address: 192.168.1.50 Event Log Entry: Time: 2023-10-05 14:25:10 Event ID: 4648 Source: Security User: jdoe Logon Type: 2 Account Name: jdoe Account Domain: CORP Target Server: FILE-SRV-01 Additional Info: A logon was attempted using explicit credentials. Workstation Name: WS-001 IP Address: 192.168.1.50
Based on the exhibit, what is the MOST likely scenario?
Quick Answer
The correct answer is that an attacker brute-forced the password and then used the credentials to access a file server. This conclusion is drawn from the classic signature of a brute-force attack in Windows Event Logs: a burst of Event ID 4625 (failed logon) events for a single account within a short window, immediately followed by a single Event ID 4624 (successful logon) and then an Event ID 5140 (file share access). The rapid, repeated failures indicate automated guessing, while the sudden success and subsequent file access confirm the attacker compromised the password and moved laterally to a file server. On the CISM exam, this scenario tests your ability to correlate multiple log events into a coherent attack narrative, a key skill in incident detection and response. A common trap is mistaking the failed logons for a denial-of-service attempt or ignoring the follow-up access event. Memory tip: think “4625s then 4624 equals brute-force success—always check what happens next.”
⚠ Common exam trap
The trap here is that candidates may misinterpret the failed logons as a user simply forgetting their password (Option B), but the rapid, repeated failures followed by a successful logon and file access clearly indicate a brute-force attack rather than a benign password mistake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker brute-forced the password and then used the credentials to access a file server.
The exhibit shows multiple failed authentication attempts (Event ID 4625) from a single user account within a short time window, followed by a successful logon (Event ID 4624) and then an access event to a file share (Event ID 5140). This pattern of rapid, repeated failures culminating in a single success is characteristic of a brute-force attack, where the attacker guesses the password and then uses the compromised credentials to access a file server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A user is performing a scheduled task that requires authentication.
Why it's wrong here
Scheduled tasks typically run under system accounts, not with explicit credentials.
- ✗
A user forgot their password and successfully logged in after retrying.
Why it's wrong here
The pattern shows a failed attempt followed by success, but the explicit credential use to a file server suggests more than a simple mistake.
- ✓
An attacker brute-forced the password and then used the credentials to access a file server.
Why this is correct
The sequence indicates successful guess followed by lateral movement.
- ✗
A system administrator is testing password policies.
Why it's wrong here
There is no indication of administrative intent; it appears malicious.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the log entries, what is the most likely scenario?
hard- ✓ A.A brute-force attack against the root account
- B.A remote code execution attempt
- C.A legitimate user repeatedly mistyping their password
- D.A misconfiguration causing duplicate log entries
Why A: The rapid succession of failed SSH login attempts for the root account from the same IP address indicates a brute-force attack, making Option A the most likely scenario. Option B is not supported because the logs show only failed authentication attempts, not signs of code execution. Option C is less likely given the speed and repetitive nature of the attempts. Option D is incorrect as the entries are distinct failed logins, not duplicates.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.