A penetration test reveals that the login form is vulnerable to credential stuffing. How can this be mitigated?

Question

Options

• ARequire multi-factor authentication for all users
• BImplement single sign-on for the application
• CRestrict login attempts to trusted IP addresses only
• DDisable HTTPS on login pages

• A
  75% (18)
• B
  4% (1)
• C
  8% (2)
• D
  13% (3)

Explanation

Multi-factor authentication (MFA) directly neutralizes credential stuffing because even when attackers successfully match stolen username/password pairs, they cannot complete login without the second factor - making the stolen credentials useless. Credential stuffing works precisely because users reuse passwords, so MFA breaks that attack chain at its core.

Why the distractors are wrong:

• B (SSO): Single sign-on consolidates authentication but doesn't add protection against credential stuffing - it just moves the vulnerable login to one central place.
• C (Trusted IPs only): Blocking by IP is brittle and impractical for most applications; attackers routinely rotate IPs or use residential proxies to bypass this, and it locks out legitimate remote users.
• D (Disable HTTPS): This is the opposite of a security measure - removing HTTPS exposes credentials to interception in transit, making the attack surface dramatically worse.

Memory tip: Think of MFA as a "second lock on the door." Credential stuffing steals your key (password), but MFA means the attacker still can't get in without the deadbolt code (your phone/token). Any answer that adds a verification layer the attacker can't steal from a database dump is the right instinct.

No community discussion yet for this question.