What is the difference between a password spraying attack and a brute force attack, and why does password spraying evade traditional account lockout policies?

• A.There is no functional difference; both are rate-limited by the same lockout policy
• B.Password spraying uses a dictionary while brute force uses random characters; both trigger the same account lockout threshold
• C.Password spraying is a network-level attack on the RADIUS server; brute force attacks the Active Directory directly
• D.Brute force tries many passwords against one account (triggering lockout quickly); password spraying tries one common password (e.g., 'Summer2024!') against many accounts simultaneously. Password spraying evades lockout by keeping attempts per account below the lockout threshold (e.g., 2 attempts per account per hour)