ITPEC FE Subject B April 2026 Question 17
From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.
Company P conducts training sessions for junior security analysts within its security team. As part of this training activity, the team reviews simulated authentication log data and discusses how different password attack techniques may manifest in real-world systems. The purpose of this exercise is to help analysts accurately identify attack patterns, understand attacker behavior, and evaluate the defensive controls that are effective against each type of attack.
During the exercise, the team focuses on three major password attack techniques, understanding that their visibility in authentication logs varies as summarized in Table 1.
Table 1 Major password attack techniques
As part of the training, the security team reviews multiple sample authentication logs recorded at an authentication server, as summarized in Tables 2 and 3. The participants analyze the authentication patterns observed in both tables and determine the correspondence of each pattern corresponds to the password attack techniques listed in Table 1.
Table 2 Sample authentication logs (Pattern A)
Table 3 Sample authentication logs (Pattern B)
Based on this analysis, they conclude that the pattern observed in Table 2 is categorized as A, and that observed in Table 3 is categorized as B, as summarized in Table 1.
Answer group
Explanation
A: brute force attack, B: credential stuffing attack — one account hammered with wrong passwords, versus many accounts tried once each with some successes.
Table 2 (Pattern A): one source IP, one username admin, six failures two minutes apart and no success. Many passwords tried against a single account is the brute force pattern in Table 1.
Table 3 (Pattern B): one source IP but six different usernames, each tried once, and two of them (emma., olivia.) authenticate. Attempts spread over many accounts with occasional success is the credential stuffing pattern: the attacker replays leaked username-password pairs, and some are still valid.
Answer (a)
Why not others:
- •(b), (d), (e) and (f) — each assign offline password cracking to one of the patterns, but Table 1 states it works on stolen hashes without contacting the authentication server, so it leaves no entries in these logs
- •(c) — names the right two techniques but swaps them, matching the single-account pattern to credential stuffing and the many-account pattern to brute force
Key rule: In authentication logs, look at how attempts spread over accounts: many failures on one account suggest password guessing, while single attempts across many accounts with some successes suggest reused stolen credentials.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.