A Burglar Trying Every Key
Eight failed logins. 2:41 a.m. An unknown device. One success. The attack is hiding in the pattern, not in any single line — this lesson teaches you to read the authentication log like an analyst.
In an online password attack, an adversary tries one credential after another against a login page — common passwords, predictable patterns, stolen secrets — until one works. The "rattling doorknob" leaves traces in the log: a burst of failures, attempts at strange hours, logins from devices you've never seen. No single line proves an attack, but the pattern across them does.
Read the Log
Spot failed-attempt bursts, odd hours, unknown devices, and the one success that matters.
Judge the Password
See why predictable patterns hand adversaries an easy guess — and what strong looks like.
Harden Access
Stack unique passwords, passphrases, managers, and MFA to push risk down.
Learning objectives
- Identify common signs of a password attack.
- Explain how adversaries take advantage of weak authentication.
- Explain how to make authentication stronger.
Imagine a burglar standing at a door with a ring of keys, trying one after another after another. An online password attack does the same thing to a login page. The traces it leaves in the authentication log — failures, strange hours, unfamiliar devices — only become an attack when read together as a pattern.
Weak passwords are the keys an attacker already owns.
When Weak Authentication Becomes an Opening
Guessing only works when passwords are guessable — and strength comes from being unpredictable and layered.
In an online password attack, adversaries try to log in by guessing — using common passwords, common patterns, or passwords stolen from elsewhere. Because the guessing happens against a live login page, it usually leaves a visible trail.
Common signs of a password attack
Analysts watch for three repeating signals: many failed login attempts in a short window, attempts at unusual times (like the middle of the night), and attempts from unknown devices the account has never used.
Why weak authentication helps the attacker
Many people build passwords from predictable patterns — a word or two plus a two-digit number and a symbol, family or pet names, or meaningful dates. If an adversary knows a little about the target, those patterns shrink the guessing problem dramatically.
What stronger authentication looks like
Strength comes from being unpredictable and layered: long, random, unique passwords; long passphrases; a password manager to make uniqueness practical; avoiding names, dates, and personal details; and turning on multifactor authentication (MFA) wherever it's offered.
One failed login is noise — people fat-finger passwords. A cluster of failures, off-hours, from a new device, is signal. Analysts read clusters, not lines.
"A failed login" is not, by itself, evidence of an attack. The exam rewards the pattern: frequency + timing + unknown device + a success after repeated failures.
MFA is usually the strongest single mitigation, because even a correctly guessed password fails without the second factor. Rank mitigations by how much risk they remove.
"Which evidence most strongly suggests..." and "Which mitigation is strongest?" are ranking prompts — they want the best answer, not just a correct one.
Authentication Strength Builder
LAB · BUILDToggle the controls Maya might use. Some raise the strength meter; some quietly tear it down. Watch the gauge react.
Tip: the strongest setups combine a long unique secret with MFA.
The Language of Authentication
Know these terms precisely — the FRQ rewards naming a specific indicator and a specific control.
Authentication
The process of proving a user is who they claim to be before granting access.
Online password attack
Guessing credentials against a live login page using common passwords, patterns, or stolen secrets.
Weak authentication
Predictable or reused secrets (names, dates, word+##) that make guessing far easier.
Multifactor authentication (MFA)
Requiring a second factor beyond the password, so a guessed password alone cannot grant access.
Password manager
A tool that generates and stores long, random, unique passwords so users never reuse or simplify them.
Passphrase
A long string of unrelated words — hard to guess, easier to remember than random characters.
Authentication log
A record of login events: time, result, device, and location — the analyst's primary evidence.
Indicator of compromise (IOC)
Evidence that an account or system has likely been breached, such as a success after a failure burst.
What AP Wants You to Explain
This topic maps to AP Skill 3 (Detect Attacks) with Skill 2 (Mitigate), across MCQ and the Device Security Analysis FRQ.
Ranking prompts — "which evidence most strongly suggests" and "which mitigation is strongest" — want the best answer with justification, not just a correct one. The strongest evidence is usually the combined pattern (frequency + timing + unknown device + post-failure success). The strongest mitigation is usually MFA, because a guessed password alone can no longer grant access.
Device Security Analysis Connection
Expect an authentication-log excerpt and a prompt to interpret it defensively. Points come from naming a specific indicator, explaining the risk, and recommending one improvement — tied to evidence, not guesswork.
03:12 AM FAIL ×6 user=maya_r device=Unknown-Tablet region=Other
03:13 AM SUCCESS user=maya_r device=Unknown-Tablet region=Other
03:14 AM CHANGE recovery_email updated device=Unknown-Tablet
Using the excerpt: (1) identify one indicator of suspicious activity, (2) explain why it suggests risk, and (3) recommend one authentication improvement.
Reveal model reasoning
(2) Why it suggests risk: Repeated failures then a success from an unfamiliar device is a classic sign of an online password attack that may have succeeded; the immediate recovery-email change suggests the attacker is trying to keep control of the account.
(3) Recommended improvement: Enable multifactor authentication and reset to a long, unique password. MFA most strongly reduces risk because a guessed password alone can no longer grant access.
Triage the Log, Then Build the Answer
Investigate a real-looking authentication log, then watch how the strongest-evidence answer is constructed.
Suspicious Login Log Analyzer
LAB · TRIAGEMaya Rivera noticed her gaming account felt "off" and her home Wi-Fi was slow last night. She exported the account's authentication log. Click each event you think is suspicious or high-risk — you'll get an analyst's verdict on every row.
| Time | Result | Device | Location | Your call |
|---|---|---|---|---|
| 7:14 PM | Success | Maya-iPhone | Home | tap to flagNormal |
| 9:02 PM | Success | Maya-Laptop | Home | tap to flagNormal |
| 2:38 AM | Failed | Unknown-PC | Other region | tap to flagSuspicious |
| 2:41 AM | Failed ×8 | Unknown-PC | Other region | tap to flagHigh-risk |
| 2:43 AM | Success | Unknown-PC | Other region | tap to flagHigh-risk |
| 2:45 AM | Setting change | Unknown-PC | Other region | tap to flagHigh-risk |
| 7:50 AM | Success | Maya-iPhone | Home | tap to flagNormal |
Verdict
02:41:02 FAIL user=maya_r device="Unknown-PC" region=Other
02:41:14 FAIL user=maya_r device="Unknown-PC" region=Other
02:41:29 FAIL user=maya_r device="Unknown-PC" region=Other
02:41:41 FAIL user=maya_r device="Unknown-PC" region=Other
02:42:03 FAIL user=maya_r device="Unknown-PC" region=Other
02:42:18 FAIL user=maya_r device="Unknown-PC" region=Other
02:42:34 FAIL user=maya_r device="Unknown-PC" region=Other
02:42:51 FAIL user=maya_r device="Unknown-PC" region=Other
02:43:09 SUCCESS user=maya_r device="Unknown-PC" region=Other
Question: Which evidence most strongly suggests an online password attack — and why isn't a single failed login enough?
✗ Common wrong answer
"The single failed login proves an attack." — A lone failure is noise. The AP point comes from combining frequency + timing + unknown device + the post-failure success. Evidence is read as a pattern, not a single line.
Where Points Get Lost
Most missed marks come from over-reading one line, or recommending the weaker fix.
✗ One line = an attack
A single failed login is noise. Evidence is a pattern: frequency + timing + unknown device + a post-failure success.
✗ "Just use a stronger password"
A longer password helps, but MFA removes far more risk — a guessed password alone can't get in. Rank by risk removed.
✗ Symbols make it strong
Predictability, not character variety, is what's weak. "Buddy2011!" is predictable; a long unique passphrase is not.
✗ Ignoring the post-login change
A recovery-email or password change right after an unknown sign-in is the attacker keeping access — name it as an IOC.
Classify Passwords, Reconstruct the Incident
Rate password patterns, walk the evidence timeline, then review how analysts reason.
Password Pattern Risk Evaluator
LAB · CLASSIFYClassify each fictional password by how risky its pattern is. We're judging predictability — not teaching anyone how to crack anything.
Attack Evidence Timeline
LAB · RECONSTRUCTReveal each stage of the incident on Maya's account. Tap a card to see the indicator of compromise (IOC) it represents.
Burst of failed login attempts
Attempts from an unknown device & region
Successful login after the failures
Account setting changes
Tapped 0 / 4 — each stage adds to the case for compromise.
Never trust one clue
- A single failed login is normal; a cluster is a signal
- One event rarely proves an attack — patterns do
Compare patterns
- Timing, frequency, device identity, location, success/failure
- Contrast suspicious events against the account's normal baseline
Recommend without blame
- Strengthen controls (MFA, unique password) — don't shame the user
- Good security reduces risk and stays usable
Document the reasoning
- Connect each piece of evidence to the conclusion it supports
- Record what was observed, what it means, and what action followed
Prove It, Then Lock It In
Five checks across signs, weak passwords, and strongest mitigation — then the exam-day essentials.
Five takeaways
An online password attack guesses common passwords, patterns, or stolen credentials against a live login.
Signs of an attack: many failed attempts, unusual times, and unknown devices — read as a pattern, not one line.
Predictable patterns (pet names, dates, word+##) weaken authentication, especially against attackers who know the target.
Stronger authentication = long, unique, random secrets or passphrases, a password manager, and MFA.
A success right after repeated failures from an unknown device is a strong indicator of compromise — report and reset.
✓ AP Exam Tip
For "which evidence most strongly suggests" or "which mitigation is strongest," give the best answer and justify it — usually the combined pattern, and MFA for mitigation.
✗ Common Mistake
Don't call a single failed login an attack. And don't recommend "a stronger password" alone when MFA removes far more risk.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.