SANS560 GIAC Penetration Tester (GPEN) Practice Test

Understanding whether account lockout is in place and how it works is essential when testing authentication. Verifying this with administrators helps you avoid unintentionally locking out real users and ensures you stay within authorized, safe boundaries. You want to know if the system enforces a lockout after a certain number of failed logins, the exact threshold, how long the lockout lasts, and how the counter resets. Also clarify any exemptions for privileged or service accounts, whether there are maintenance windows or special rules, and the approved procedure if a lockout occurs during testing. It’s important to align on whether temporary disabling, targeted testing windows, or active monitoring is permitted, and to have written authorization in place. The other options listed aren’t related to login security and wouldn’t help you manage lockout risk.