Account lockouts should
-
Only be used on administrator accounts to ensure continuous access to users
-
Only be used on user accounts to ensure that administrators are not locked out of the application
-
Only be used when there is a secure process to unlock the account
-
None of the above
Reveal answer
Fill a bubble to check yourself
C
Correct answer
Explanation
Account lockouts are a security control to prevent brute force attacks, but they must be paired with a secure unlock process (like admin verification or multi-factor authentication). Without a safe recovery mechanism, lockouts can become a denial-of-service vulnerability where attackers deliberately lock out legitimate users. Options A and B are incorrect because lockouts should apply to all sensitive accounts, not selectively.