CEH Wireless, IoT and Cloud Security Practice Question
A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?
⚠ Common exam trap
Test-takers frequently choose account lockout (Option D) thinking it stops brute-force attacks, but credential stuffing uses valid passwords from breaches, so lockout is ineffective and can be easily evaded with distributed IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable multi-factor authentication (MFA) for all users.
Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enforce complex password policies.
Why it's wrong here
Enforcing complex password policies, while generally good security practice, primarily mitigates brute-force attacks against individual accounts or dictionary attacks. It does not prevent credential stuffing because this attack vector relies on users reusing credentials that have already been compromised in other breaches. If a complex password is reused across multiple services, its complexity offers no protection when it's "stuffed" into a new login form, as the attacker already possesses the valid combination.
- ✓
Enable multi-factor authentication (MFA) for all users.
Why this is correct
Enabling multi-factor authentication (MFA) for all users is the most effective defense against credential stuffing attacks. Even if an attacker successfully uses a stolen username and password combination, they will be unable to authenticate without possession of the second factor, such as a one-time code from an authenticator app, a hardware token, or a biometric verification. This additional layer of security renders the compromised credentials useless for unauthorized access, making it the strongest preventative measure.
- ✗
Implement CAPTCHA on the login page.
Why it's wrong here
Implementing CAPTCHA on the login page offers some protection against unsophisticated automated bot attacks but is not a robust solution for credential stuffing. Sophisticated attackers can employ CAPTCHA-solving services, use advanced bots that bypass common CAPTCHA mechanisms, or even leverage human CAPTCHA farms. Furthermore, in a cloud-based Identity Provider (IdP) scenario, the primary authentication flow might occur via APIs or federated protocols where CAPTCHA integration is often impractical or non-existent, diminishing its overall effectiveness.
- ✗
Enable account lockout after 3 failed attempts.
Why it's wrong here
While account lockout policies are crucial for mitigating brute-force attacks against specific user accounts, they are largely ineffective against credential stuffing. Attackers performing credential stuffing typically use a large list of known username/password pairs, attempting each pair only once or a few times across many different accounts. This distributed approach avoids triggering lockout thresholds for any single account, allowing the attacker to test thousands or millions of credentials without interruption, or even cause a denial-of-service by locking out legitimate users.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.