A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame. Which of the following is the MOST likely cause of this issue?
A) A password-spraying attack was performed against the organization.
B) A DDoS attack was performed against the organization.
C) This was normal shift work activity; the SIEM's AI is learning.
D) A credentialed external vulnerability scan was performed.

Question

Quizplus · Accepted Answer

A password-spraying attack involves attempting to log in to many accounts using a few common passwords, which aligns with the scenario of numerous login attempts across all domain accounts.

A Security Analyst Received an Alert from the SIEM Indicating