Identity logs show many municipal accounts receiving one or two failed logons with the same common password, then quiet periods, rather than thousands of guesses against one account. Which attack pattern is this?
Select an answer to reveal the explanation.
Short Explanation
Spraying is the 'one wrong key on every door' approach. Attackers try a popular password across lots of accounts so lockout counters barely tick—unlike hammering one VIP account into oblivion.
Full Explanation
Password spraying tries one or a few common passwords across many accounts so per-account lockout thresholds rarely trip. Identity logs showing many municipal accounts with one or two failures using the same common password, then quiet periods, match spray tradecraft rather than a focused hammer on a single VIP. Cities with large clerk and seasonal workforces are attractive spray targets because password reuse and weak seasonal accounts still appear.
Classic brute force concentrating huge attempts on a single VIP account produces dense failures against one identity and often rapid lockout of that account—opposite of the wide, shallow pattern described. RFID cloning of physical badges at the garage reader is physical credential copying, not directory logon failures with a shared password. Rootkit concealment of processes on a jump host hides malware from local tools; it does not generate distributed failed-logon telemetry across many accounts.
Exam caveat: spraying versus brute force is a high-frequency SY0-701 distinction—breadth with few tries each versus depth against one target. Lockout-avoidance is part of the spray concept; do not require proof of success to recognize the pattern in logs.
Operational check: alert on same-password failures across many municipal identities, enforce MFA, block known-bad passwords, tighten lockout and detection for spray-shaped telemetry, and review privileged accounts for spray successes that left only quiet follow-on activity.