A municipal tester proposes spraying AD passwords during the city’s lunch peak without checking lockout policy. What constraint should shape that decision first?
Select an answer to reveal the explanation.
Short Explanation
Lunch rush is when help desks already drown in tickets — do not add a wave of locked civic accounts. Spray-class tests live or die on lockout math and the RoE clock. Speed without those checks is just how you become the outage.
Full Explanation
Credential spraying against Active Directory can trigger lockouts and availability impact if volume and timing ignore account lockout thresholds and engagement windows. Professional practice requires confirming lockout policy, coordinating timing, and staying within rules of engagement before spray-class attempts. Short wordlists alone do not make spraying safe, and lockout controls do apply to domain accounts. Methodology favors careful, authorized authentication testing over opportunistic floods.