easyMultiple Choice
Identifying Brute-Force Attacks from Windows Event Logs
A security analyst is reviewing logs and finds multiple failed login attempts from an external IP address followed by a successful login. Which type of attack is most likely occurring?
⚠ Common exam trap
It's easy for candidates to confuse 'brute force' with 'credential stuffing' because both involve multiple login attempts, but credential stuffing uses known breached credentials (often from different IPs) and shows a higher initial success rate, whereas brute force targets a single account with many guesses from one IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute force attack
A brute force attack involves systematically trying all possible password combinations until the correct one is found. The log pattern of multiple failed attempts from a single external IP followed by a success is the classic signature of a brute force attack, as the attacker iterates through a password list or character space against the same username.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password spraying
Why it's wrong here
Password spraying tries a few common passwords across many accounts to avoid lockouts, producing scattered failures across usernames, not repeated failures against one account from a single IP. It is tempting because it also yields eventual success, but the log pattern here shows concentrated guessing against one credential.
- ✓
Brute force attack
Why this is correct
Repeated failed authentications from one external address immediately followed by success indicates systematic credential guessing until the correct password was found. Brute force attacks iterate through password combinations against a known account, matching the log pattern of many failures then one success.
- ✗
Credential stuffing
Why it's wrong here
Credential stuffing replays username and password pairs breached elsewhere across many accounts, generating failures spread across numerous usernames. It is tempting because it also ends in a successful login, but the stem shows repeated failures against a single account from one IP, indicating guessing rather than breached-pair replay.
- ✗
Social engineering
Why it's wrong here
Social engineering manipulates people into revealing credentials or granting access; it leaves no brute-force failure pattern in authentication logs. It is tempting because it is a common initial access route, but the observed sequence of repeated failed logins from one external IP followed by success indicates automated credential guessing.
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which security threat is likely being attempted?
medium- A.DNS poisoning
- B.Man-in-the-middle attack
- ✓ C.Brute-force attack
- D.SQL injection
Why C: The exhibit shows a large number of failed login attempts (e.g., 'Login failed' or 'Authentication error') from a single source IP within a short time window, which is the classic signature of a brute-force attack. This attack systematically tries multiple username/password combinations to gain unauthorized access, and the repeated failure messages in the logs confirm the attempt.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.