An organization is looking to improve its defenses against attackers attempting to guess passwords in order to breach user accounts. Which of the following is the BEST mitigation strategy to protect against such an attack?
Deploy an intrusion detection system to monitor network traffic for suspicious behavior.
Implement an account lockout mechanism after three unsuccessful login attempts.
Implement a Virtual Private Network (VPN) for remote access to the network.
Encrypt all data stored on user devices.
Require passwords to meet stronger complexity requirements, including a mix of uppercase, lowercase, numbers, and special characters.
Add challenge-response questions to the login process.