Courseiva
← CC
Full test
mediumMultiple Choice

Brute-Force Attack: Identifying the Log Pattern with Multiple Usernames

Exhibit

Refer to the exhibit.

```
[Windows Security Log]
Event ID 4625: An account failed to log on.
Account Name: jdoe
Source Network Address: 192.168.1.100
Failure Reason: Unknown user name or bad password.
Count: 15 occurrences in 5 minutes.
```

Refer to the exhibit. A security analyst reviews this log entry. What type of attack is most likely occurring?

Quick Answer

The correct answer is a brute-force attack. This is because the log entry reveals repeated failed authentication attempts from a single source IP address, 10.10.10.10, targeting multiple usernames like admin, root, and test within a very short time window—a classic pattern of systematically trying different credential combinations against a system. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your ability to distinguish between a brute-force attack and password spraying; the key differentiator is that brute-force attacks hammer one source IP against many usernames, while password spraying uses one common password across many accounts. A common trap is confusing this with a dictionary attack, but the log shows attempts across usernames, not just passwords. Remember the memory tip: brute-force is a "broad net" from one IP, while password spraying is a "single key" tried on many locks.

⚠ Common exam trap

ISC2 often tests the distinction between brute-force and password spraying attacks, where the trap is that candidates confuse the target pattern—brute-force focuses on a single user with many passwords, while password spraying uses one password across many users.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute-force attack

The log entry shows repeated failed authentication attempts against a single username from a single source IP, trying numerous different passwords in a short period. This pattern is characteristic of a brute-force attack, where an attacker systematically tries many password guesses against one target account.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Pass-the-hash attack

    Why it's wrong here

    Pass-the-hash reuses a captured NTLM hash for authentication, appearing as a successful logon with NTLM where Kerberos was expected, not failed password attempts. It would be correct if the exhibit showed type 3 logons succeeding without a preceding interactive logon.

  • ✓

    Brute-force attack

    Why this is correct

    Repeated failed sign-in attempts against one account within a short window indicate an attacker systematically guessing credentials. This pattern, rather than a single failure, distinguishes brute-force from other attacks and satisfies the log evidence showing numerous authentication attempts.

  • ✗

    Password spraying attack

    Why it's wrong here

    Password spraying tries one common password across many accounts to avoid lockouts, so the exhibit would show many distinct usernames each with few failures. The log instead shows repeated failures against a single account, which is brute force, not spraying.

  • ✗

    Kerberos ticket attack

    Why it's wrong here

    A Kerberos ticket attack involves forged or manipulated ticket-granting tickets (golden/silver tickets), producing event IDs such as 4769 with anomalous encryption types, not the repeated authentication failures shown. It would be correct if the log revealed abnormal TGS requests rather than credential-guessing patterns.

About these practice questions

One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

3 more ways this is tested on CC

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security analyst is reviewing event logs and notices multiple failed login attempts from a single IP address followed by a successful login. Which TWO actions should the analyst take next?

easy
  • A.Disable the user account immediately.
  • ✓ B.Escalate to the incident response team.
  • ✓ C.Investigate the source IP address for malicious activity.
  • D.Block the IP address at the firewall.
  • E.Reset the password for the affected account.

Why B: Option B is correct because a failed-login-then-success pattern is a classic indicator of a brute-force or credential-stuffing compromise, which is a security incident that must be escalated to the incident response team for containment, eradication, and forensic analysis. Option C is correct because the analyst must investigate the source IP address (e.g., via WHOIS, threat-intel reputation lookups, or checking it against known IoC feeds) to determine whether it is a known malicious host, a compromised internal system, or part of a botnet before deciding on further containment. Option A is not the best next step because disabling the account before confirming compromise could disrupt a legitimate user and destroy forensic evidence; account lockout/disable is a containment action taken after validation. Option D is also premature, since blocking the IP at the firewall without investigation could block a legitimate proxy, NAT gateway, or shared egress point and does not address the already-successful login. Option E is not appropriate yet because resetting the password before confirming the compromise and scoping the incident could tip off the attacker and erase useful artifacts; password reset is a remediation step performed after escalation and investigation.

Variation 2. Refer to the exhibit. A security analyst sees these logs from a Linux server. Which security control should the analyst recommend to address this pattern?

medium
  • A.Enable account lockout after 5 failed attempts.
  • B.Disable root login via SSH.
  • C.Block the IP address 192.168.1.100 via firewall.
  • ✓ D.Implement two-factor authentication for SSH access.

Why D: The logs show repeated failed SSH login attempts from a single IP (192.168.1.100) targeting the root account, which is a classic brute-force attack pattern. Two-factor authentication (2FA) for SSH access is the most effective control because it adds a second authentication factor (e.g., TOTP or hardware token) that an attacker cannot bypass even if they guess the password, thus neutralizing the brute-force attack regardless of the number of attempts or the account targeted.

Variation 3. Refer to the exhibit. An analyst sees these logs. What type of attack is occurring?

medium
  • A.Phishing
  • B.SQL injection
  • ✓ C.Brute-force attack
  • D.Port scan

Why C: A brute-force attack is characterized by repeated, systematic authentication attempts against a login endpoint, typically producing a high volume of failed login events from a single source IP or targeting a single account in rapid succession. The log exhibit shows this pattern of repeated authentication failures, which is the signature of credential-guessing automation tools like Hydra or Medusa. Unlike a port scan (which probes many ports) or SQL injection (which embeds SQL syntax in input fields), brute-force activity focuses on the authentication mechanism itself.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.