How many repeated failed login attempts should be allowed until an account lockout?

How many repeated failed login attempts should be allowed until an account lockout?

• A. 4
• B. 5
• C. 6
• D. 7

Answer: (C)

Limiting consecutive failed logins is about balancing security and user accessibility to stop brute-force guessing while still letting legitimate users recover from occasional typos. In PCI-aligned guidance, the account should be locked after six consecutive failed attempts. This threshold provides a reasonable barrier against automated attacks, yet isn’t so strict that a user who mistypes a password a couple times is permanently blocked. After the lock, you should enforce a defined lockout duration or require an administrator reset, with a secure unlock process. Setting the limit lower makes lockouts more common and burdens users; setting it higher gives attackers more chances. Six is a commonly accepted middle ground.

Limiting consecutive failed logins is about balancing security and user accessibility to stop brute-force guessing while still letting legitimate users recover from occasional typos. In PCI-aligned guidance, the account should be locked after six consecutive failed attempts. This threshold provides a reasonable barrier against automated attacks, yet isn’t so strict that a user who mistypes a password a couple times is permanently blocked. After the lock, you should enforce a defined lockout duration or require an administrator reset, with a secure unlock process. Setting the limit lower makes lockouts more common and burdens users; setting it higher gives attackers more chances. Six is a commonly accepted middle ground.