300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ42

Threat Hunting Outcomes

A security engineer finds that a user was locked out of an email account following multiple failed sign-in attempts. Further investigation shows that other users had the same problem. The lockouts resulted from incorrect credentials being used during authentication.

What is the attack indicator?

Explanation

A short, concentrated burst of failed sign-in attempts from different countries is a strong indicator of a coordinated, distributed password-guessing attack. Password-spray attacks target multiple accounts with common passwords, and abnormal clusters of authentication failures or sign-ins from unfamiliar locations warrant investigation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!