Joe notices there are several user accounts on the local network generating spam with embedded malicious code. Which of the following technical control should Joe put in place to BEST reduce these…

Account lockout policies automatically lock user accounts after a defined number of failed login attempts or can be triggered by suspicious behavior, directly preventing compromised accounts from continuing to send spam or execute malicious code. This is a reactive and preventive technical control that targets the compromised accounts themselves, cutting off their ability to cause further harm on the network.

Group Based Privileges controls what resources groups of users can access, but does not directly stop already-authenticated compromised accounts from sending spam.

Least privilege limits what actions and resources a user account can access, but if the account is already compromised and has sufficient permissions to send email, it does not stop the ongoing spam activity.

Password complexity helps prevent accounts from being compromised in the first place, but since the accounts are already generating spam, enforcing complexity now does not immediately stop the active incidents.