CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What is the most common defense against brute-force login attacks on web applications?
- A.Account lockout after repeated failed attempts and/or rate limiting
- B.Removing the login page
- C.Longer usernames
- D.Using HTTP instead of HTTPS; rate limiting is applied per application rather than per client identity
Why A is correct
Account lockout (temporarily locking an account after N failed attempts) and rate limiting (throttling login attempts per IP/account) are primary defenses. Additional measures include CAPTCHA, progressive delays, MFA, and monitoring for distributed attacks. Be careful with lockout - it can enable DoS by locking legitimate accounts.
Know someone studying for Security Fundamentals? Send them this one.