You are a Microsoft 365 administrator for a company. You need to identify security vulnerabilities by using the Office 365 Attack Simulator. Which three attack simulations are available? Each…

Brute-force password attack is a built-in simulation in Attack Simulator that attempts to crack user passwords by systematically trying a large number of password combinations, helping administrators identify accounts with weak passwords.

Cross-site scripting (XSS) is a web application vulnerability testing technique and is not one of the attack simulation types offered in the Office 365 Attack Simulator.

Password-spray attack is a built-in simulation that attempts a single commonly used password against many accounts simultaneously, which helps identify accounts vulnerable to this low-and-slow credential attack technique.

Denial-of-service (DoS) simulation is not available in the Office 365 Attack Simulator, as the tool focuses on credential and phishing-based attacks rather than network availability attacks.

Display name spear-phishing is a built-in phishing simulation in Attack Simulator that spoofs a trusted sender's display name to trick targeted users into clicking malicious links, testing user susceptibility to social engineering attacks.