ITPEC FE Subject B April 2026 Question 17

Pattern A is a brute force attack and Pattern B is credential stuffing.

Table 2 — one source IP, one username admin, six failures two minutes apart, no success. Many passwords tried against a single account is brute force by definition.

Table 3 — one source IP but six different usernames, two of which authenticate successfully. Known username-password pairs replayed across many accounts, with a few still valid, is credential stuffing.

Answer (a)

Why not others:
- (b), (d), (e) and (f) — each assigns offline password cracking to one of the patterns, but Table 1 states it never interacts with the authentication system, so it leaves no authentication log entries at all and cannot explain either table
- (c) — names the right two techniques but swaps them, matching the many-usernames pattern to the single-account attack

Key rule: Read the username column first. One username repeated means the attacker is guessing the password; many usernames with occasional success means they already hold passwords and are testing where those still work.

AI-generated — may contain errors