Password Spraying vs Brute-Force Attack Identification

SY0-601 By islever Editorial Last updated

Short answer

A The attack is described as password spraying, where an attacker tries a few common passwords against many user accounts to avoid detection.

Question

The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced failed log-in attempts when authenticating from the same IP address: Which of the following most likely describes the attack that took place? - Exhibit: Password Spraying vs Brute-Force Attack Identification
  1. Spraying Correct Answer
  2. Brute-force
  3. Dictionary
  4. Rainbow table

Key Takeaways

The question tests your ability to differentiate attack vectors by observing target distribution; the common trap is assuming multiple failures equal brute-force, ignoring the multi-account pattern.

This page clarifies the distinction between password spraying and brute-force attacks based on log analysis. It establishes that widespread failed attempts across many accounts from a single source indicate a specific low-and-slow technique.

Common mistake: Brute-force (B) is the most common wrong answer because candidates associate 'failed logins' with high-volume guessing against a single target, missing the 'significant portion of user accounts' clue.

Expert Analysis

Why the Answer Is Correct

The correct answer is A (Spraying). The key indicator in the scenario is that "a significant portion of the user accounts" experienced failed attempts from the same IP. Password spraying involves taking a large list of usernames and trying a few common passwords (like 'Password123') against all of them. This approach minimizes the risk of triggering account lockout mechanisms associated with targeting a single account repeatedly.

Why the Other Options Are Wrong

Brute-force (B) and Dictionary (C) attacks typically focus on a single target account, attempting many different passwords until one works. While they cause failed logins, they do not inherently spread attempts across a large percentage of the user base simultaneously. Rainbow tables (D) are pre-computed tables for reversing hash functions and are used offline; they do not generate network login events or logs.

Community Comment Notes

The community strongly supports Option A. As user Elle noted, "Password spraying... is when one password is applied to multiple user IDs." Another user, AnandC2022, correctly identified that the attempt was made against "different user accounts," distinguishing it from single-target attacks. Users like Hs1208 emphasized that this technique is designed to evade lockouts by spreading attempts out.

Exam Strategy

When analyzing security logs, always check the scope of the target. If you see failures across many accounts from one source, think 'Spraying'. If you see many failures on one account, think 'Brute-force' or 'Dictionary'.

Frequently Asked Questions

Why is this not a brute-force attack?

Brute-force targets one account with many passwords. Spraying targets many accounts with few passwords.

What is the main goal of password spraying?

To bypass account lockout policies by keeping failed attempts low per individual account.

More SY0-601 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. 1403ad2 👍 11 Answered A
    choose A 2024-20-2 On Test and passed with 802
  2. Elle 👍 4 Answered A
    Password spraying for sure because in a brute force attack, hackers choose a vulnerable ID and enter passwords one after another hoping some password might let them in. On the other hand, password spraying, is when one password is applied to multiple user IDs so that at least one of the user ID is compromised.
  3. AnandC2022 👍 4 Answered A
    I think the answer should be spraying because they were attempting to log in with different user accounts.
  4. insanegrizly 👍 3
    Has to be either brute force or spraying... Since we cannot see the input it's hard to judge. On one hand, spraying generally use password, go next, use password, go next....etc. On the other hand brute force generally goes untill lockout took place, which we cannot see. Overall, shitty question.
  5. Hs1208 👍 2 Answered A
    A. Spraying The described attack most likely corresponds to a "Password Spraying" attack. In a password spraying attack, the attacker attempts to gain unauthorized access to multiple user accounts by trying a few commonly used passwords against many usernames
Show 6 more comments
  1. ArunRavilla 👍 1
    It is for sure Brute-force because Brute-force attacks are generally characterized by multiple failed login attempts for a single account or multiple accounts. Whereas Spraying attacks are designed to evade account lockout mechanisms that might trigger with multiple failed attempts for a single account.
  2. chizzuck 👍 1 Answered A
    A Spraying. Attack an account with the top three (or more) passwords – If they don’t work, move to the next account – No lockouts, no alarms, no alerts
  3. Harrisb10 👍 1
    So, the correct answer is brute-force? I would think spraying would be the correct answer.
  4. 8c4769c 👍 2 Answered A
    Answer should be spraying.
  5. Jhonattan0032 👍 2 Answered A
    A Is the correct answer
  6. johnabayot 👍 1 Answered A
    A. Spraying

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide