ISC2 CISSP Practice Question

Implementing credential lockout mechanisms that impose an exponentially increasing delay after each unsuccessful attempt directly throttles the rate at which an attacker can submit guesses. This control turns what would otherwise be millions of guesses per minute into only a handful per hour, making online brute-force attacks impractical. Complexity rules enlarge the keyspace but do not slow submission speed; expiration policies address compromised credentials, not guessing; and log monitoring merely detects activity after it occurs rather than preventing it.