A login endpoint has no lockout or rate limiting. An attacker uses Burp Suite's Intruder tool with a 10,000-entry password list. What is this attack called and what is the primary mitigation?

• A.Password spraying; the primary mitigation is multi-factor authentication on each account, combined with a ban on common passwords and a minimum length enforced at registration
• B.SQL injection against the login query; the primary mitigation is parameterized statements, along with input length limits and escaping
• C.Session hijacking of the login cookie; the primary mitigation is Secure and HttpOnly flags, along with a short idle timeout
• D.Online password brute-forcing; primary mitigation is account lockout or progressive delays after N failed attempts, combined with rate limiting per IP and per account