Implementing account lockout thresholds is the most effective method to mitigate against password spraying attacks. After several failed attempts, the account will be locked, preventing further unauthorized tries. While changing default passwords and using multi-factor authentication provide additional layers of security, they do not directly address the issue of multiple password attempts. Password complexity requirements do not protect against the use of a variety of common passwords.