Exam CV0-003 topic 1 question 313 discussion

B. **Progressive login delay** Progressive login delay, also known as rate limiting or login throttling, is a security control that can help mitigate brute force attacks on user accounts. It works by introducing a delay or slowing down the login process after a certain number of failed login attempts. This delay increases with each subsequent failed attempt, making it increasingly difficult for an attacker to conduct a brute force attack. Implementing a progressive login delay can help protect user accounts from unauthorized access without significantly impacting the user experience for legitimate users, especially when combined with other security measures like account lockout and account recovery options. It's an effective way to thwart automated password-guessing attacks while allowing legitimate users to log in without excessive hindrance.

Explanation: A progressive login delay slows down repeated login attempts by introducing increasing time delays after each failed login attempt. This makes brute force attacks significantly less effective without negatively impacting legitimate users. ✔ Mitigates brute force attacks by exponentially increasing response time after multiple failed attempts. ✔ Does not lock out users permanently, reducing frustration and support tickets. ✔ Maintains security without requiring more complex passwords or affecting user experience.

B. Progressive login delay: This method gradually increases the delay between login attempts after each failed attempt, making brute force attacks significantly more time-consuming and less feasible, without locking out users or requiring them to change their behavior.

I thought A would be more effective, it doesn't let the attacker attempt to login again without the account being unlocked. This stops the attacker from attempting to brute force after a certain amount of attempts and it doesn't effect user experience as the user can simply ask the help desk to unlock the account and reset the password if they forgot it.