A web developer wants to ensure that a new web application is not vulnerable to brute-force attacks. Which of the following best practices is MOST useful to meet this goal?

Input validation checks user input against defined rules to prevent vulnerabilities like SQL injection or cross-site scripting, but it doesn't specifically stop repeated password guessing attempts.

System updates patch known vulnerabilities and improve overall security, but they don't directly implement a mechanism to block brute-force password guessing attempts at the application login level.

Password lockout is a security feature that temporarily prevents further login attempts on an account after a certain number of consecutive failed authentication attempts. This mechanism directly thwarts brute-force attacks by making it computationally infeasible for attackers to guess passwords through repeated automated tries, as their attempts will quickly lead to the account being locked.

Login auditing records login attempts, which is useful for detection and forensics, but it does not actively prevent a brute-force attack from succeeding in real-time.