In a password guessing test, what action helps mitigate risk of lockouts while testing?

• A. Coordinate with target personnel to monitor any account lockouts.
• B. Disable all account lockout policies on the target.
• C. Immediately perform password resets for all users.
• D. Ignore lockouts and continue testing.

Answer: (A)

Coordinating with the target team to monitor any account lockouts is the best approach because it grounds testing in collaboration and control. By keeping security personnel informed, you can stay within the agreed rules of engagement, observe how your password guessing activity impacts real user accounts, and pause or adjust quickly if lockouts start affecting legitimate access. This proactive communication reduces the chance of causing denial of service, helps you interpret lockout events correctly, and allows you to schedule testing in a safe window with appropriate monitoring.

Disabling account lockout policies undermines protective controls and can leave systems more vulnerable. Performing resets for all users is disruptive and often unnecessary for a controlled test. Ignoring lockouts and continuing testing risks harming users and triggering incident responses.