What is the maximum number of failed login attempts allowed before a user ID is locked out?

What is the maximum number of failed login attempts allowed before a user ID is locked out?

• A. Five attempts.
• B. Eight attempts.
• C. Not more than six attempts.
• D. Ten attempts.

Answer: (C)

Enforcing an account lockout after a small, defined number of consecutive failed logins is a key authentication control. It stops automated guessing while still letting legitimate users recover. The threshold commonly used is six failed attempts; after the sixth failure, the account is locked and access is blocked until an unlock procedure is completed. This makes six the maximum number of allowed failures before lockout. The other options would trigger lockout sooner or later than this standard threshold, which either adds unnecessary friction for users or increases the risk of credential guessing.

Enforcing an account lockout after a small, defined number of consecutive failed logins is a key authentication control. It stops automated guessing while still letting legitimate users recover. The threshold commonly used is six failed attempts; after the sixth failure, the account is locked and access is blocked until an unlock procedure is completed. This makes six the maximum number of allowed failures before lockout. The other options would trigger lockout sooner or later than this standard threshold, which either adds unnecessary friction for users or increases the risk of credential guessing.