What happens if there are more than five unsuccessful attempts to enter the confirmation code during MFA login?

Veeam Backup & Replication V12 includes a security mechanism to protect against brute-force attacks during Multi-Factor Authentication (MFA) login. If a user fails to enter the correct confirmation code five consecutive times, the system will temporarily lock the user account. This lockout is a protective measure that lasts for one minute, after which the user can attempt to log in again. This short duration prevents automated attacks while minimizing disruption for legitimate users who may have made a mistake.

A. The user is not permanently locked out; the lockout is a temporary security measure designed to thwart brute-force attempts.

B. A 24-hour lockout is excessively long for this type of protection; the actual duration is much shorter to balance security and usability.

D. The lockout period is specifically defined as one minute in the product documentation, not one hour.

1. Veeam Backup & Replication User Guide for VMware vSphere v12

"Security and Roles

" section: "Multi-Factor Authentication (MFA)

" Page 1.

Quote: "To prevent brute-force attacks

Veeam Backup & Replication will block the user account for 1 minute after 5 unsuccessful attempts to enter the confirmation code."