Which of the following is a recommended mitigation for password attacks?

• A. Disable password expiration policies.
• B. Use simple, easily guessable passwords for convenience.
• C. Implement multi-factor authentication (MFA) for accounts.
• D. Disable account lockout mechanisms.

Answer: (C)

Multi-factor authentication adds a second form of verification to login, such as a code from a authenticator app, a hardware token, or a biometric factor, in addition to the password. This means that even if a password is compromised through phishing, guessing, or data breaches, the attacker still needs the second factor to gain access. The extra layer makes credential-only attacks much less likely to succeed because knowledge alone is no longer enough.

Disabling password expiration policies reduces the incentive for users to rotate credentials and can allow compromised passwords to remain valid longer. Using simple, easily guessable passwords creates a weak foundation that is easily breached even with other protections in place. Disabling account lockout mechanisms removes a key safeguard against rapid guessing and brute-force attempts.