Which attack mitigation must be in place to prevent an attacker from authenticating to a service using a brute force attack?

Question

Options

• AForced password change every 6 months
• BUse of a 100 ms delay between each authentication
• CUse of a password manager
• DUse of multifactor authentication for all accounts

• A
  4% (1)
• B
  4% (1)
• D
  91% (21)

Explanation

Multifactor authentication (MFA) stops brute force attacks because even if an attacker correctly guesses a password, they still cannot authenticate without the second factor (a token, biometric, or device confirmation) - something they don't have. This fundamentally breaks the attack regardless of how many password attempts are made.

Why the distractors are wrong:

• A (forced password change every 6 months) - changing passwords periodically reduces the window a stolen password is useful, but does nothing to stop an attacker actively brute-forcing credentials in real time.
• B (100 ms delay between authentications) - a small delay is far too short to meaningfully slow a brute force attack; proper rate limiting or lockout policies are needed, and 100 ms is not a recognized mitigation standard.
• C (password manager) - a password manager helps users create and store strong, unique passwords, which reduces guessability, but a determined attacker with enough time or a weak password can still brute-force it without MFA blocking the final login.

Memory tip: Think of MFA as a second lock on the door - brute-forcing the first lock (the password) becomes pointless if the attacker can't get past the second lock they don't control.

No community discussion yet for this question.