Security+ password spraying, stuffing and brute force
Password spraying tries a small set of common guesses across many accounts. Credential stuffing reuses stolen username-password pairs from another service. Brute-force guessing explores candidate secrets, while offline cracking tests against stolen verifier data without contacting the live login service. The distinction matters because online throttling does not protect a stolen database in the same way it protects a login endpoint.
How to read the scenario
Look at where the attacker obtains candidates, how many accounts are targeted, and whether guesses are made online or offline.
Identify the required outcome, the evidence already provided, and the limits on the technician’s action. Compare every option against those details before deciding. Record why the closest alternative does not meet the stated need.
Original practice example
An attacker tries one common password against many different accounts to reduce per-account lockouts. Which technique is this?
- Offline password cracking
- Password spraying
- Brute-force attack
- Credential stuffing
Show the answer and explanation
Password spraying
Password spraying spreads a small set of guesses across many accounts.
Study questions
Which objective does this guide support?
SY0-701, objective 2.4. This independent guide supports original practice and does not replace the full official objectives.
What should I watch for in a scenario?
Look at where the attacker obtains candidates, how many accounts are targeted, and whether guesses are made online or offline.
Source and version
CompTIA official SY0-701 objectives, objective 2.4. Verified November 5, 2026. This guide targets SY0-701. SY0-801 is expected around November 17, 2026 and is outside this edition.