ISC2 CC Access Controls Concepts Practice Question
An organization configures account lockout after 5 failed login attempts within 15 minutes. This control is designed to mitigate which type of attack?
⚠ Common exam trap
It's easy for candidates to confuse brute-force with other credential-related attacks; candidates may pick phishing because both involve passwords, but only brute-force is mitigated by limiting failed attempts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute-force attack
Account lockout after 5 failed attempts within 15 minutes is a classic defense against brute-force attacks, which rely on rapidly submitting many password guesses until one succeeds. By locking the account after a small number of failures, the control drastically reduces the number of attempts an attacker can make in a given time window, making automated guessing impractical. This is a standard mitigation recommended by frameworks like NIST and CIS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Phishing
Why it's wrong here
Lockout counters repeated authentication failures against one account, throttling online password-guessing; phishing steals credentials through deception and never triggers the threshold. It is tempting because lockout is an authentication control, but it belongs to brute-force or credential-stuffing scenarios, where limiting attempts per account is the intended mitigation.
- ✓
Brute-force attack
Why this is correct
Lockout thresholds directly throttle repeated authentication failures, so an attacker cannot iterate passwords indefinitely. The 5-attempts-in-15-minutes constraint caps the guessing rate, defeating brute-force attempts while allowing legitimate users to retry after the lockout window expires.
- ✗
Social engineering
Why it's wrong here
Lockout counters repeated authentication failures, whereas social engineering manipulates people into divulging credentials or granting access, often succeeding on the first attempt with no failed logins recorded. It is tempting because stolen credentials may follow a phishing campaign, but lockout addresses brute-force and password-guessing, not human manipulation.
- ✗
Man-in-the-middle attack
Why it's wrong here
A man-in-the-middle attack intercepts traffic between two parties, which lockout cannot detect or prevent; it targets repeated authentication attempts against an account. It is tempting because intercepted credentials could be replayed, but that requires session or channel protection, not failure counting.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Account lockout
Account lockout is a security feature that temporarily disables a user account after a set number of failed login attempts to prevent unauthorized access.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.