ITPEC IP April 2026 Question 37
Among the following attacks against an information system, which attack can be prevented by stopping the use of a given ID when mistakes are made during the entry of a password for the ID more than the preset number of times, ?
Explanation
Brute force attack — locking an ID after a set number of wrong passwords stops the attacker trying password after password.
A brute force attack tries every possible password, or a great many of them, against one ID until one works. Its strength is unlimited retries. Account lockout removes that: after a few failures the ID can no longer be used, so the attacker gets only a handful of guesses.
Answer (c)
Why not others:
- •(a) DoS attack — floods a server with traffic or requests to make it unavailable; it guesses no password. A lockout can even be abused for denial of service, by locking legitimate users out
- •(b) SQL injection — slips SQL into input fields to manipulate the database; the defence is placeholders (bind variables) and escaping input
- •(d) Phishing — tricks users into entering their password on a fake site; the attacker then logs in right first time, so a limit on failures does not help
Key rule: Account lockout counts failures per ID, so it stops guessing against one ID; attacks that try one common password across many IDs (reverse brute force) avoid it.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.