mediumMultiple ChoiceObjective-mapped

Brute-Force Attack: Identifying the Log Pattern with Multiple Usernames

Exhibit

Refer to the exhibit.

```
[Windows Security Log]
Event ID 4625: An account failed to log on.
Account Name: jdoe
Source Network Address: 192.168.1.100
Failure Reason: Unknown user name or bad password.
Count: 15 occurrences in 5 minutes.
```

Refer to the exhibit. A security analyst reviews this log entry. What type of attack is most likely occurring?

Quick Answer

The correct answer is a brute-force attack. This is because the log entry reveals repeated failed authentication attempts from a single source IP address, 10.10.10.10, targeting multiple usernames like admin, root, and test within a very short time window—a classic pattern of systematically trying different credential combinations against a system. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your ability to distinguish between a brute-force attack and password spraying; the key differentiator is that brute-force attacks hammer one source IP against many usernames, while password spraying uses one common password across many accounts. A common trap is confusing this with a dictionary attack, but the log shows attempts across usernames, not just passwords. Remember the memory tip: brute-force is a "broad net" from one IP, while password spraying is a "single key" tried on many locks.

⚠ Common exam trap

ISC2 often tests the distinction between brute-force and password spraying attacks, where the trap is that candidates confuse the target pattern—brute-force focuses on a single user with many passwords, while password spraying uses one password across many users.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Brute-force attack

The log entry shows repeated failed authentication attempts against a single username from a single source IP, trying numerous different passwords in a short period. This pattern is characteristic of a brute-force attack, where an attacker systematically tries many password guesses against one target account.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Pass-the-hash attack
Why it's wrong here
Pass-the-hash uses NTLM hashes, not multiple failed logins.
✓
Brute-force attack
Why this is correct
Repeated failed attempts on the same account indicate brute-force.
✗
Password spraying attack
Why it's wrong here
Password spraying targets many accounts with one password; this targets one account.
✗
Kerberos ticket attack
Why it's wrong here
Kerberos attacks involve ticket manipulation, not login failures.

Go deeper

3 more ways this is tested on CC

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security analyst is reviewing event logs and notices multiple failed login attempts from a single IP address followed by a successful login. Which TWO actions should the analyst take next?

easy

A.Disable the user account immediately.
✓ B.Escalate to the incident response team.
✓ C.Investigate the source IP address for malicious activity.
D.Block the IP address at the firewall.
E.Reset the password for the affected account.

Why B: Options B and C are correct. Investigating the source IP address for malicious activity (C) helps determine if there is a broader threat, and escalating to the incident response team (B) ensures proper handling. The other options—disabling the account, blocking the IP at the firewall, or resetting the password—may be necessary later but should not be performed without further investigation.

Variation 2. Refer to the exhibit. A security analyst sees these logs from a Linux server. Which security control should the analyst recommend to address this pattern?

medium

A.Enable account lockout after 5 failed attempts.
B.Disable root login via SSH.
C.Block the IP address 192.168.1.100 via firewall.
✓ D.Implement two-factor authentication for SSH access.

Why D: The logs show repeated failed SSH login attempts from a single IP (192.168.1.100) targeting the root account, which is a classic brute-force attack pattern. Two-factor authentication (2FA) for SSH access is the most effective control because it adds a second authentication factor (e.g., TOTP or hardware token) that an attacker cannot bypass even if they guess the password, thus neutralizing the brute-force attack regardless of the number of attempts or the account targeted.

Variation 3. Refer to the exhibit. An analyst sees these logs. What type of attack is occurring?

medium

A.Phishing
B.SQL injection
✓ C.Brute-force attack
D.Port scan

Why C: The logs show repeated failed login attempts from the same IP address. This pattern is characteristic of a brute-force attack, where an attacker tries many password combinations to gain unauthorized access. Phishing involves tricking users into revealing credentials, SQL injection targets database queries, and port scans probe for open ports.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.

Brute-Force Attack: Identifying the Log Pattern with Multiple Usernames

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

3 more ways this is tested on CC