Which of the following controls is the most effective in mitigating activities of bots that...

User account lockout is the most effective control listed for mitigating bot-driven repeated login attempts. Bots often attempt credential stuffing, brute-force guessing, or repeated authentication attempts. Account lockout limits the number of failed attempts before temporarily disabling access, forcing additional verification, or triggering security review. Password length improves password strength, but it does not stop continuous attempts by bots. Session timeout controls inactive authenticated sessions, not repeated failed logins. Password aging requires periodic password changes, but it is weak against automated attempts and may even lead to poor password practices. Internal auditors reviewing authentication controls should assess lockout thresholds, monitoring, alerting, multifactor authentication, and exception handling. Therefore, Option C is correct.