A website locks a user's account after three unsuccessful login attempts. This precaution prevents which of the following?

A (Shoulder surfing) involves observing someone's screen or keyboard directly, which an account lockout does not prevent.

B (Phishing) is a social engineering attack to trick users into revealing credentials, which an account lockout does not directly address.

C (Spam) refers to unsolicited bulk electronic messages, unrelated to login attempts or account security.

D (Password cracking) is prevented by account lockout policies because these policies limit the number of login attempts, making it computationally infeasible for attackers to guess passwords through automated trial-and-error methods like brute-force or dictionary attacks. Once the account is locked, further attempts are blocked, halting the cracking process.