PenTest+ differentiates password spraying from brute-force attacks. Brute force (as shown in A, C, and D) rapidly tests many passwords per user, producing a high rate of failed logins that commonly triggers defensive controls such as rate limiting, account lockout policies, WAF/IDS alerts, and IP reputation blocks. This is especially true in federated authentication flows, where identity providers and reverse proxies log and correlate repeated failures.
Option B reflects a spraying approach that is designed to be low-and-slow and policy-aware. A spraying tool that supports building an execution plan and adding delays between authentication attempts reduces the likelihood of crossing thresholds that cause automated blocking. In PenTest+ terms, this aligns with conducting authentication testing in a controlled manner to avoid service disruption and to minimize detection while still validating whether weak or reused passwords exist.