During an overnight monitoring shift, a security analyst receives an alert from the SIEM indicating a spike in authentication failures against the payroll database server. The log excerpt shows 1,425 consecutive invalid password attempts for service account "svr-pay" before a single successful logon originating from the same external IP address at 03:17 local time. The organization does not allow remote administration of this server, and no maintenance window was scheduled. Based on the log data and circumstances, which of the following is the MOST reasonable conclusion about what occurred?
The server automatically rebooted, generating benign authentication events from the remote KVM console.
An attacker used automated password guessing to compromise the account through a brute-force attack.
The database administrator forgot the password and eventually succeeded after multiple tries.
A scheduled patch-management agent triggered the log entries during its normal job window.
The clustered pattern of hundreds of failed attempts followed immediately by a successful logon outside approved maintenance hours strongly indicates an automated brute-force attack. Such attacks systematically guess credentials until a correct combination is found, generating many authentication failures in a short period. A legitimate user forgetting a password would rarely trigger thousands of failures from the same IP, a scheduled job would not run from an external address or outside its window, and a routine reboot would not cause repeated invalid passwords. Therefore, the most likely scenario is that an attacker gained access by brute forcing the service account's password.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a brute-force attack?
Open an interactive chat with Bash
What is a SIEM and how does it help in detecting attacks?
Open an interactive chat with Bash
Why are service accounts like 'svr-pay' often targeted in attacks?