What is the minimum lockout duration after a user is locked out?

What is the minimum lockout duration after a user is locked out?

• A. 8 hours.
• B. 60 minutes.
• C. 15 minutes.
• D. Minimum of 30 minutes or until an administrator enables the user ID.

Answer: (D)

Locking an account after failed login attempts is a security control to slow down brute-force or credential-stuffing attacks. Setting a minimum lockout duration protects users and systems by preventing rapid repeated guesses, while still allowing legitimate access to be restored when appropriate. The best choice states a minimum of 30 minutes, or until an administrator unlocks the user ID. This captures two important ideas: first, the user must wait at least 30 minutes before trying again, which reduces the window for automated guessing; second, an administrator can unlock the account if the user is legitimate and needs access sooner. The other options either propose shorter or longer durations than the required minimum, which doesn’t meet the specified policy, and they don’t include the admin unlock option that legitimately handles approved access restoration.

Locking an account after failed login attempts is a security control to slow down brute-force or credential-stuffing attacks. Setting a minimum lockout duration protects users and systems by preventing rapid repeated guesses, while still allowing legitimate access to be restored when appropriate.

The best choice states a minimum of 30 minutes, or until an administrator unlocks the user ID. This captures two important ideas: first, the user must wait at least 30 minutes before trying again, which reduces the window for automated guessing; second, an administrator can unlock the account if the user is legitimate and needs access sooner. The other options either propose shorter or longer durations than the required minimum, which doesn’t meet the specified policy, and they don’t include the admin unlock option that legitimately handles approved access restoration.