The signal for credential stuffing is always prior breach data + a different target site. The attacker is not guessing — they are replaying. Lockout cannot stop an attack that sends exactly one correct attempt per account. Slash the trash: brute force would require many attempts per account; password spraying uses one shared common password across accounts (not unique pairs from a breach); dictionary attack uses a wordlist of probable guesses, not confirmed credentials.

Two separate flaws exist here: (1) deterministic “salt” — the username is public and predictable, so an attacker who knows the username can precompute a targeted rainbow table for that user; and (2) fast algorithm — SHA-256 is optimized for speed, allowing billions of guesses per second offline. A proper implementation requires a randomly generated per-user salt (unpredictable, even if the attacker knows usernames) plus bcrypt/Argon2 (slow by design). MD5 (option C) is worse than SHA-256 for password storage, not better.

NIST SP 800-63B counterintuitive facts are high-frequency exam targets: forced rotation reduces security rather than increasing it, because it drives predictable incremental patterns. The employees are not “failing to comply” — they are responding rationally to an unworkable policy. The correct approach is: no forced rotation unless compromised, minimum 15–16 character length, block known-breached passwords at creation, and support passphrases up to 64 characters.

I and III are both genuine, targeted improvements: bcrypt directly defeats offline brute force by making each hash guess expensive; random salts directly defeat precomputed rainbow tables by ensuring every hash is unique. Statement II sounds reasonable but contradicts NIST — forced rotation causes users to cycle through predictable patterns, producing passwords like “Company60!” that an attacker who recovered “Company59!” could trivially guess. The validity window argument fails in practice because the pattern is crackable before expiration.

Slash the trash systematically: (A) Rainbow table is defeated by the bcrypt + salt already in place — eliminate. (B) Brute force against bcrypt at cost factor 10 is impractical; and lowering lockout to 3 would not stop spraying at 1 attempt/account — eliminate. (C) Deploying bcrypt is already done; it does not stop spraying or stuffing, which never touch the hash database — eliminate. (D) is correct: the LinkedIn email list enables password spraying using the default “Welcome2026!” credential (1 attempt per account, 23% success rate = ~322 accounts). The pharmacy breach enables credential stuffing (61% reuse = ~854 employees at risk). MFA stops both: even with a valid or default password, the attacker cannot authenticate past the second factor.