An attacker tries thousands of passwords per minute on one account. Which control helps most directly?
Options
- A bigger server to handle all of the traffic
- Rate limiting and account lockout, plus MFA (Correct option)
- Changing the URL of the login page every month
- Using shorter passwords so users remember them
Answer
Rate limiting and temporary lockout of login attempts, plus MFA
Why
Guessing passwords by trying many combinations is a brute-force attack.
If the server allows only a few attempts per minute per account and IP (rate limiting), and adds delays or temporary lockouts, guessing becomes impractical.
MFA makes a correct guess useless on its own.
Remember
Brute force → rate limiting + lockout + MFA.