Question
A security analyst is reviewing the following logs:
```
[10:00:00 AM] Login rejected - username administrator - password Spring2023
[10:00:01 AM] Login rejected - username jsmith - password Spring2023
[10:00:01 AM] Login rejected - username guest - password Spring2023
[10:00:02 AM] Login rejected - username cpolk - password Spring2023
[10:00:03 AM] Login rejected - username fmartin - password Spring2023
```
Which of the following attacks is most likely occurring?
- A. Password spraying Correct
- B. Account forgery
- C. Pass-the-hash
- D. Brute-force
Explanation
The log shows one common password, Spring2023, being tried against many different usernames within a few seconds, which is the pattern of password spraying: a single likely password is tried across many accounts to avoid per-account lockout. A brute-force attack would instead try many passwords against the same account. Pass-the-hash reuses a captured password hash rather than submitting a plaintext password, and account forgery is not a login attack pattern shown here.
