220-1102 Question 516
Single answerFailed log-in attempts restrictionsA small office uses Windows 11 Pro laptops joined to a workgroup. Several employees report that they were temporarily unable to sign in after mistyping their passwords a few times. The office manager wants to reduce password-guessing attacks on the laptops, but also wants to avoid causing frequent help desk calls from users being locked out all day. Which local security policy setting would BEST address this requirement?
- A
Configure an Account lockout threshold with a reasonable number of invalid attempts and set an Account lockout duration
- B
Disable password complexity requirements so users are less likely to mistype their passwords
- C
Increase the minimum password age so users cannot change their passwords as often
- D
Enable auditing for logon events only, without changing any lockout-related settings
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure account lockout policies, specifically the Account lockout threshold and Account lockout duration settings. In Windows, these settings are found in Local Security Policy under Account Policies > Account Lockout Policy. They are designed to slow or stop brute-force and password-guessing attempts by locking an account after a defined number of failed logins. A reasonable threshold and duration help balance security and usability, which is exactly what the scenario requires. Related settings may also include Reset account lockout counter after, which determines when the failed-attempt counter returns to zero. Microsoft security best practices and standard administrative guidance treat account lockout policy as the appropriate control for failed sign-in restrictions, whereas password complexity, password age, and auditing serve different purposes.
- A. Correct.
Correct. In Windows local security policy, account lockout settings are specifically used to restrict failed sign-in attempts. Setting an Account lockout threshold defines how many failed attempts are allowed before the account is locked, and Account lockout duration determines how long the lockout remains in effect. This directly helps mitigate password-guessing attacks while allowing administrators to choose a duration that balances security with usability.
- B. Incorrect.
Incorrect. Disabling password complexity does not address repeated failed sign-in attempts. It would weaken security by making passwords easier to guess, which increases the risk of unauthorized access. A user mistyping a password is a usability issue, but lowering password standards is not an appropriate control for failed log-in restrictions.
- C. Incorrect.
Incorrect. Minimum password age controls how soon a user can change a password again after changing it. It does not limit failed login attempts or help protect against brute-force password guessing. Someone might choose this option because it is a password policy setting, but it is unrelated to login attempt restrictions.
- D. Incorrect.
Incorrect. Auditing logon events can help administrators detect and investigate failed sign-in attempts, but auditing alone does not restrict or stop repeated login failures. This is a monitoring control, not a preventive control. The scenario asks for the best setting to reduce password-guessing attacks while limiting long lockouts.