CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What is the most common defense against brute-force login attacks on web applications?
- A.A. Removing the login page
- B.D. Longer usernames
- C.C. Using HTTP instead of HTTPS
- D.B. Account lockout after repeated failed attempts and/or rate limiting
Why D is correct
Account lockout (temporarily locking an account after N failed attempts) and rate limiting (throttling login attempts per IP/account) are primary defenses. Additional measures include CAPTCHA, progressive delays, MFA, and monitoring for distributed attacks. Be careful with lockout - it can enable DoS by locking legitimate accounts.
Know someone studying for Security Fundamentals? Send them this one.