John works as a professional Ethical Hacker. He has been assigned a project to test the security server. Now, he suggests some countermeasures to avoid such brute force attacks on the We-are- secure…

Periodic password rotation is a general credential hygiene practice that limits the window of exposure for already-compromised passwords but does not prevent a brute force attack from occurring against the current password.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a direct countermeasure against brute force because automated attack tools cannot reliably solve challenge puzzles, effectively blocking scripted login loops after a threshold of failed attempts.

Increasing the encryption key length used to store or transmit passwords (e.g., AES-128 vs AES-256) strengthens data-at-rest or in-transit security but does not impede an attacker submitting guesses through the login interface, which is how brute force attacks operate.

Restricting login attempts to a fixed number (such as three) before locking the account or imposing a delay is a classic account lockout policy that directly prevents brute force attacks by making exhaustive credential guessing computationally impractical.