Lockout Observation Window refers to:

• A. The time window over which bad logon attempts are counted; after this time, the counter resets.
• B. The period after which a locked account expires.
• C. The interval for auditing user logins only during business hours.
• D. The window for password history checks during change.

Answer: (A)

Lockout observation window is the period during which failed logon attempts are counted toward the lockout threshold. If the threshold is met or exceeded within this window, the account is locked; once the window passes, the count resets and new failures start fresh.

For example, with a policy of 5 failed attempts within 15 minutes, five consecutive failures within that 15-minute span will lock the account. If more than 15 minutes pass since the first failure, the counter resets, and subsequent failures no longer count toward the previous window.

The other ideas describe different concepts: how long a locked account remains disabled, auditing during specific times, or password history checks during changes, none of which govern how failed attempts are aggregated over time.