Which two actions can be taken to enforce protection from brute force attacks in the security policy? (Choose two.)