John works as a professional Ethical Hacker. He has been assigned a project to test the security server. Now, he suggests some countermeasures to avoid such brute force attacks on the We- aresecure se

Increasing encryption key length for stored passwords raises the cost of offline hash cracking but does not prevent an attacker from submitting unlimited guesses against a live login form.

Restricting login attempts to three tries before locking the account or imposing a delay directly prevents an attacker from iterating through large password lists, which is the core mechanism of a brute force attack.

Forcing periodic password changes is a credential hygiene practice that reduces the window of exposure for compromised passwords, but it does not stop an active brute force attempt from succeeding within a session.

CAPTCHA challenges after a set number of failed attempts distinguish human users from automated scripts, blocking the scripted repetition that makes brute force attacks feasible.