Courseiva
← SSCP
Full test
mediumMultiple ChoiceObjective-mapped

Identifying Brute-Force Attacks from Windows Event Logs

Exhibit

Refer to the exhibit.

Exhibit: Windows Event Log
```
Event ID 4625: An account failed to log on.
Subject: Security ID: S-1-5-18, Account Name: SYSTEM
Logon Type: 3
Account For Which Logon Failed: Security ID: NULL SID, Account Name: Administrator
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Workstation Name: WORKSTATION1
Source Network Address: 10.0.0.200
```

A security analyst sees the event log exhibit. What does this indicate?

Quick Answer

The event log pattern described, repeated failed logon attempts against the built-in Administrator account from a remote source using varying passwords, points directly to a remote attacker systematically attempting to guess that account's password. Windows Event ID 4625 records failed logon attempts, and the Logon Type field is what tells you where the attempt originated: a Logon Type of 3 indicates a network logon, meaning the attempt came in over the network from a remote address rather than from someone physically at the console. Combined with a non-zero source network address or workstation name in the log entry, this confirms the activity isn't an authorized administrator fumbling their own local password, but an external party probing the account remotely. The Administrator account is a particularly attractive target for this kind of attack because it's a well-known, high-privilege built-in account present on virtually every Windows system, so attackers frequently script repeated logon attempts against it hoping to eventually guess a weak or reused password. Recognizing this pattern matters for exam questions generally: whenever a log shows repeated failed attempts against a single account followed by clues about the connection type or source address, check the Logon Type and source address fields first, since they're what distinguish a remote attack from ordinary local user error.

⚠ Common exam trap

Many exam-takers confuse Logon Type 3 (network) with interactive logon (Type 2) or assume any failed logon for Administrator means a local user, but the presence of a remote IP address and Logon Type 3 specifically indicates a remote brute-force attack.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A remote attacker attempted to log on as Administrator

The event log shows multiple failed logon attempts for the built-in Administrator account from a remote IP address (e.g., 10.0.0.5) using different passwords, which is a classic brute-force attack pattern. Event ID 4625 (Windows Security Log) with Logon Type 3 (Network logon) and a non-zero workstation name or source network address confirms the attempts originated remotely, not from the console. This indicates a remote attacker is systematically trying to guess the Administrator password.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    A local user typed wrong password at the console

    Why it's wrong here

    Logon Type 3 is network, not console.

  • ✓

    A remote attacker attempted to log on as Administrator

    Why this is correct

    Logon Type 3 and source IP indicate remote attempt.

  • ✗

    An attacker used a nonexistent account

    Why it's wrong here

    The account 'Administrator' exists; failure is due to bad password.

  • ✗

    The Administrator account is locked out

    Why it's wrong here

    Only a failed logon, not lockout.

About these practice questions

This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on SSCP

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security analyst is reviewing logs and finds multiple failed login attempts from an external IP address followed by a successful login. Which type of attack is most likely occurring?

easy
  • A.Password spraying
  • ✓ B.Brute force attack
  • C.Credential stuffing
  • D.Social engineering

Why B: A brute force attack involves systematically trying all possible password combinations until the correct one is found. The log pattern of multiple failed attempts from a single external IP followed by a success is the classic signature of a brute force attack, as the attacker iterates through a password list or character space against the same username.

Variation 2. Based on the exhibit, which security threat is likely being attempted?

medium
  • A.DNS poisoning
  • B.Man-in-the-middle attack
  • ✓ C.Brute-force attack
  • D.SQL injection

Why C: The exhibit shows a large number of failed login attempts (e.g., 'Login failed' or 'Authentication error') from a single source IP within a short time window, which is the classic signature of a brute-force attack. This attack systematically tries multiple username/password combinations to gain unauthorized access, and the repeated failure messages in the logs confirm the attempt.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.