Which of the following controls mitigates the risk of Matt, an attacker, gaining access to a company network by using a former employee's credential?

Account expiration sets an end date on a user account so that it automatically becomes disabled when that date passes, or ensures that offboarding procedures include expiring the account immediately. This directly addresses the threat of a former employee retaining valid credentials, because even if the attacker knows the correct password, the expired account will be rejected at authentication. This is the most targeted control for the specific scenario of credential misuse by departed personnel.

Password complexity strengthens passwords against guessing but does not help if the former employee already knows their password, which they set themselves.

Account lockout triggers on repeated failed login attempts; it does not prevent a former employee who knows their correct credentials from successfully authenticating on the first try.

Dual factor authentication adds a second verification step but does not mitigate the risk if the former employee still possesses both factors, such as their password and a registered mobile device.