Account lockouts should
-
Only be used on administrator accounts to ensure continuous access to users
-
Only be used on user accounts to ensure that administrators are not locked out of the application
-
Only be used when there is a secure process to unlock the account
-
None of the above
Reveal answer
Fill a bubble to check yourself
C
Correct answer
Explanation
Account lockouts are a security mechanism to prevent brute force attacks, but they require a secure unlock process to avoid denial of service vulnerabilities. Without a secure unlock mechanism, attackers could deliberately lock out legitimate users or administrators, causing system disruption. Options A and B are incorrect because lockouts should apply to all accounts consistently, not selectively. Option D is incorrect because C is the correct answer.