Which of the following is the BEST defense against password guessing?

Limiting external connections may reduce the attack surface from remote threats but does not prevent insider password guessing attempts or attacks originating from within the permitted network segments.

Disabling or locking an account after a limited number of unsuccessful login attempts directly interrupts automated or manual password guessing attacks by preventing further attempts. This account lockout policy ensures that even a weak password cannot be guessed through repeated trials, as the attack vector is cut off before enough attempts can succeed. It is a standard security control defined in frameworks like NIST SP 800-63B and implemented via OS and directory service policies.

Forcing a password change after an invalid entry is not a standard or practical security control and would cause severe usability issues while not actually stopping an attacker from continuing to guess the new password.

Requiring complex passwords (letters, numbers, special characters) increases the search space for guessing attacks but does not directly prevent an attacker from making unlimited guessing attempts over time.