It is a new employee's first day on the job. When trying to access secured systems, he incorrectly enters his credentials multiple times. Which…

Account lockout is a fundamental security control designed to mitigate brute-force and password-guessing attacks. When a user exceeds a predefined number of consecutive failed login attempts, the system should automatically lock the account for a specified duration or until an administrator manually unlocks it. This action prevents an attacker from making unlimited attempts to guess the user's credentials. For a new employee, this is a common occurrence due to unfamiliarity with new credentials, and the lockout mechanism protects their account while they resolve the issue, typically by contacting the IT help desk.

A. His account is deleted.

This is a destructive and disproportionate action. Deleting an account for failed logins would create a simple denial-of-service (DoS) vulnerability, allowing anyone to delete user accounts intentionally.

B. He receives a new password.

This is a resolution step, not the immediate, automated consequence of failed login attempts. A password reset is typically initiated by the user or an administrator after an account is locked.

D. He notifies Human Resources.

This is a procedural action the user might take, but it is not the automated technical response from the security system. Account access issues are typically handled by IT or a help desk, not HR.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations.

Control ID: AC-7 (Unsuccessful Logon Attempts)

Reference: In Section 2

Control AC-7 states that the system must "Enforce a limit of [organization-defined number] consecutive invalid logon attempts by a user..." and "Lock the account/node for an [organization-defined time period] or until released by an administrator when the maximum number of unsuccessful attempts is exceeded." This directly supports account lockout as the correct action.

2. National Institute of Standards and Technology (NIST) Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management.

Reference: Section 5.1.5

"Authenticator-Based Controls

" and Section 5.2.2

"Memorized Secret Verifiers

" describe the requirement for verifiers to implement mechanisms to slow down online guessing attacks. The document explicitly mentions account lockout as a primary method: "After N failed attempts

the account is locked out for a period of time."

3. Carnegie Mellon University

Information Networking Institute

Course 14-741: Introduction to Information Security.

Reference: Lecture materials on "Authentication" and "Access Control" routinely cover account lockout policies as a standard defense-in-depth measure against brute-force attacks. The principle is that after a certain threshold of failures

access should be temporarily denied to protect the account's integrity.