SY0-701 Question 120
Single answerPassword attacks: Spraying , Brute forceA company uses Microsoft 365 and receives repeated user complaints that accounts are being locked out at the start of each workday. The security analyst reviews authentication logs and sees thousands of failed sign-in attempts from a small set of IP addresses. Each username receives only one or two attempts every 30 minutes, and the passwords being tried are common values such as "Spring2026!" and "Welcome1" across many different accounts. Which type of attack is MOST likely occurring?
- A
Password spraying
- B
Traditional brute-force attack
- C
Pass-the-hash attack
- D
Rainbow table attack
Show answer and explanation
Correct answer: A
Explanation
The best answer is password spraying. In real environments, password spraying is commonly identified by low-and-slow login attempts where attackers test a few widely used passwords against many accounts rather than trying many passwords against one account. This helps attackers avoid account lockout controls that are designed to stop brute-force attempts on individual users. By contrast, brute-force attacks typically involve repeated guesses against the same account or target and are more likely to trigger lockouts quickly. This distinction aligns with common guidance from Microsoft and NIST: organizations should monitor for repeated authentication failures across many accounts from the same source, enforce strong password policies, use MFA, and tune lockout or smart lockout settings to reduce the effectiveness of password spraying while limiting denial-of-service effects from excessive lockouts.
- A. Correct.
Correct. Password spraying involves trying a small number of common passwords against many different accounts to avoid account lockout thresholds and detection tied to repeated failures on a single account. The scenario specifically describes one or two attempts per user, spaced out over time, using common passwords across many usernames, which is characteristic of spraying.
- B. Incorrect.
Incorrect. A traditional brute-force attack usually focuses on one account or a small number of accounts and tries many password combinations rapidly until one works or the account is locked. That pattern would normally generate many failures for the same username rather than a few common password attempts across a large set of accounts.
- C. Incorrect.
Incorrect. Pass-the-hash attacks involve authenticating with a captured password hash instead of the plaintext password, typically in Windows environments using NTLM-related techniques. The scenario shows failed sign-in attempts using common plaintext passwords against many accounts, which does not match pass-the-hash behavior.
- D. Incorrect.
Incorrect. A rainbow table attack is an offline cracking technique used against stolen password hashes, not a live online authentication pattern against a cloud service. Because the analyst is observing repeated failed sign-ins in Microsoft 365 logs, this is not a rainbow table scenario.