Objective 2.4: Given a scenario, analyze indicators of malicious activity
Security+ SY0-701 practice question
A SIEM alert shows 1,200 failed sign-in attempts against the company's single sign-on portal over three hours. The attempts come from a small group of IP addresses, target about 600 different usernames, and use only two passwords, Autumn2026! and Welcome1!. No account has been locked out. Which attack is MOST likely occurring?
- Password spraying(Correct)
Correct. Two passwords across roughly 600 accounts means only about two attempts per account, which stays under lockout thresholds. That pattern is the signature of password spraying.
- Brute-force attack against individual accounts
A brute-force attack against individual accounts tries many passwords against each account, which typically triggers lockouts. Here each account received only a couple of guesses and none were locked out.
- Credential replay
Credential replay reuses a captured credential or session token, such as a stolen hash or cookie, to authenticate. It would not produce over a thousand failed guesses with common passwords.
- On-path attack
An on-path attack intercepts or alters traffic between two parties. Failed sign-ins submitted directly to the portal from external addresses do not indicate interception.
Explanation
Password spraying tries a few common passwords against many accounts, keeping the attempts per account below the lockout threshold. The indicators are many usernames, very few passwords, and no lockouts. Defenses include MFA, banning common and seasonal passwords, and alerting on failed sign-ins spread across many accounts from the same sources.