What Most Effectively Reduces Brute Force Attack Success?
Short answer
A Implementing an account lockout policy immediately disables credentials after repeated failures, directly preventing successful brute force execution.
Question
Key Takeaways
Tests your ability to prioritize direct attack interruption over password complexity, with the common trap being confusing longer passwords (which increase effort) with immediate access denial.
Account lockout policies are widely recognized as the most effective control against brute force attacks. Community consensus and official CISA guidance confirm that limiting login attempts directly interrupts automated guessing.
Common mistake: Option D (requiring minimum password length) is frequently chosen because stronger passwords do increase cracking time, but they fail to actively block or stop an ongoing brute force attempt like a lockout policy does.
Expert Analysis
Why the Answer Is Correct
Account lockout policies immediately disable credentials after a defined number of failed attempts, directly halting the iterative guessing process inherent to brute force attacks. By cutting off access, the probability of success drops to near zero regardless of underlying password complexity. This aligns with ISACA’s focus on practical, high-impact authentication controls that provide real-time prevention.
Why the Other Options Are Wrong
Minimum password length (D) expands the key space but does not prevent rapid, automated trials during an active session. Increasing password change frequency (C) only mitigates long-term compromise risks, not real-time guessing. Activity timeouts (B) manage idle sessions and data leakage, offering no defense against repeated login attempts.
Community Comment Notes
Users consistently validate A as the definitive ISACA answer, noting that while longer passwords improve theoretical security, lockouts provide immediate operational protection. One contributor emphasizes that “in reality and practice the answer is always A,” reflecting exam patterns where interrupting the attack vector trumps cryptographic hardening. Another clarifies that lockout policies directly limit the attempt window, making brute force economically unviable for attackers.
Official Reference
https://csrc.nist.gov/publications/detail/sp/800-63b/final
This link opens the official vendor documentation in a new tab.
Exam Strategy
When CISA questions ask for the 'MOST effective' control against an active attack, prioritize mechanisms that immediately interrupt or block the attack vector over those that merely increase attacker effort. Always evaluate options based on real-time prevention rather than long-term risk reduction.
Frequently Asked Questions
Why isn't longer password length the best defense against brute force?
Does CISA consider account lockout better than multi-factor authentication here?
Community Votes
83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
RS66 👍 3 Answered AA. Establishing an account lockout policy
-
mdh717 👍 2 Answered AEstablishing an account lockout policy (A) is the most effective method for reducing the probability of a brute force attack being successful. A brute force attack involves trying many passwords or passphrases with the hope of eventually guessing the correct one. An account lockout policy will lock the account after a certain number of failed login attempts, thereby preventing the attacker from continuing to try different password combinations. This policy directly interrupts the brute force attack process by not allowing the attacker unlimited attempts within a short period of time.
-
shalota2 👍 2By locking an account after a certain number of unsuccessful login attempts, the probability of a brute force attack succeeding is significantly reduced. Attackers are limited in the number of attempts they can make before the account is locked, which makes brute force attacks impractical. I don't know how ISACA thinks about this but in reality and practice the answer is ALWASY A.
-
Swallows 👍 1 Answered DRequiring a minimum password length ensures that passwords are not easily guessable and increases the complexity of potential passwords, making them more resilient against brute force attacks. Longer passwords exponentially increase the time it would take for an attacker to successfully guess the correct combination, thus reducing the probability of a successful brute force attack. While an account lockout policy can deter attackers by limiting the number of login attempts, a strong password policy acts as a barrier against brute force attacks from the outset.
-
Sibsankar 👍 2A is lock
Show 1 more comment
-
Sibsankar 👍 1D is wrong, C is right
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →