A login endpoint has no lockout or rate limiting. An attacker uses Burp Suite's Intruder tool with a 10,000-entry password list. What is this attack called and what is the primary mitigation?

• A.Credential stuffing; mitigated by checking breach databases; hashing passwords client-side before transmission removes the need for TLS on the login endpoint; argon2's memory-hardness protects against phishing, because the fake site cannot allocate enough RAM to verify the password
• B.Rainbow table attack; mitigated by salted hashing
• C.Dictionary attack; mitigated by password complexity requirements; rate limiting login attempts by IP address is complete protection against password spraying from botnets; credential stuffing is brute force against one account, while spraying one password across many accounts is a dictionary attack
• D.Online password brute-forcing; primary mitigation is account lockout or progressive delays after N failed attempts, combined with rate limiting per IP and per account