What is a potential risk when password guessing triggers failed-login thresholds on a system?

• A. Account lockouts after threshold of bad attempts
• B. No effect
• C. Immediate password reset
• D. Authentication bypass

Answer: (A)

When a system enforces a failed-login threshold, it will typically lock the user’s account or impose a cooldown after enough unsuccessful attempts. This is a defensive measure to slow down brute-force guessing, but it creates a real risk: legitimate users can be blocked from accessing their accounts, leading to denial of service and potential administrative work to unlock or reset accounts. Attackers can also use lockouts to disrupt service or infer that a username exists if they observe which accounts get locked. Immediate password resets aren’t automatic outcomes of a threshold, and authentication bypass isn’t caused by standard threshold failures.