Which of the following policies would be BEST to deter a brute-force login attack?

• A. Password Complexity
• B. User Account Lockout
• C. Multi-Factor Authentication
• D. Regular Password Changes

Answer: (A)

The best approach to deter a brute-force login attack would be to implement a user account lockout policy. This specifically targets the nature of brute-force attacks, where an attacker attempts multiple username and password combinations in quick succession. A user account lockout policy minimizes the risk by temporarily locking the account after a specified number of failed login attempts. This not only stops the attack from continuing but also alerts administrators to a potential compromise.

While password complexity requirements are important for ensuring that users create strong passwords, they do not directly prevent brute-force attempts once a password is known or guessed. Multi-factor authentication adds an additional layer of security but may not be in place in all scenarios, and regular password changes, while beneficial, do not necessarily mitigate the immediate risk of repeated login attempts in the short term.

The effectiveness of the user account lockout policy in preventing unauthorized access through brute-force attacks makes it the best choice in this context.