easyMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security analyst notices repeated failed login…
A security analyst notices repeated failed login attempts from a single IP address targeting multiple user accounts. Which security control should be implemented to mitigate this attack?
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (like account lockout) and deterrent controls (like complex passwords), and the trap here is that candidates choose complex passwords because they think stronger passwords stop brute-force attacks, but they fail to recognize that unlimited attempts still allow eventual guessing regardless of password complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement account lockout after a threshold of failed attempts.
Implementing an account lockout policy after a defined threshold of failed attempts (e.g., 5 failed attempts within 15 minutes) directly mitigates brute-force password guessing attacks from a single source. This control prevents an attacker from continuously trying different passwords across multiple accounts, effectively rate-limiting the attack at the authentication layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement account lockout after a threshold of failed attempts.
Why this is correct
Mitigates brute-force attacks by locking accounts after multiple failures.
- ✗
Enable single sign-on (SSO).
Why it's wrong here
Does not address failed login attempts; SSO centralizes authentication but doesn't prevent brute force.
- ✗
Require complex passwords.
Why it's wrong here
Helps against password guessing but not automated brute force from a single IP.
- ✗
Disable the accounts after one failed attempt.
Why it's wrong here
Too restrictive; would cause denial of service for legitimate users.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.