Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is investigating a high-fidelity SIEM alert generated from cloud infrastructure audit logs. The analyst retrieves the following sequential log events originating from external IP address 198.51.100.4:

text
2026-06-14T09:12:01Z cloudtrail: User="j.smith" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:03Z cloudtrail: User="m.davis" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:05Z cloudtrail: User="a.wilson" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:10Z cloudtrail: User="r.taylor" Event="ConsoleLogin" Status="Success" SourceIP="198.51.100.4"
2026-06-14T09:12:18Z cloudtrail: User="r.taylor" Event="CreateAccessKey" Status="Success" SourceIP="198.51.100.4"

Based on these log entries, which of the following security events has occurred?

  1. A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.Answer
  2. B
    A targeted single-account brute-force attack compromised user r.taylor after repeated failed login attempts against that specific account.
  3. C
    A SQL injection attack manipulated backend web application database queries to bypass identity verification controls.
  4. D
    An authorization failure occurred because account r.taylor lacked sufficient role privileges to perform the ConsoleLogin action.

Answer

A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.
The correct option accurately identifies the log signature of a password spraying attack (multiple different target accounts tested from one IP address in rapid succession) leading to account compromise and post-exploitation persistence setup via API access key creation.

Step-by-Step Solution

1
Analyze the log entries for authentication activity patterns.
Identify that the same source IP (198.51.100.4) attempted login requests across multiple distinct user accounts (j.smith, m.davis, a.wilson, r.taylor) within seconds.
Sequential failed logins across multiple accounts from a single IP address indicate a horizontal brute-force technique known as password spraying.
2
Evaluate the outcome of the authentication attempts.
Account r.taylor logged in successfully at 09:12:10Z.
Determines that the password spraying attempt successfully identified a valid credential pair.
3
Correlate post-authentication actions.
Account r.taylor executed CreateAccessKey successfully 8 seconds after logging in.
Threat actors frequently create programmatic access keys immediately after account compromise to ensure persistent command-line or API access.

Key Concept

Log Correlation and Password Spraying Detection
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic