An administrator needs to ensure that accounts are locked permanently after repeated incorrect logins.

To change the account lockout behavior from the default (which is typically a temporary 15-minute lockout) to a permanent lockout required for high-security environments, the administrator must enable the DoD (Department of Defense) configuration compliance.

This is managed through the Security Configuration Management Automation (SCMA) framework, often found within the "Cluster Hardening" or "Security Dashboard" settings (sometimes referenced as "Additional Settings" in exam contexts). Applying the DoD STIG (Security Technical Implementation Guide) policy modifies the underlying Linux PAM (Pluggable Authentication Modules) configuration (pam_faillock) to enforce strict rules, including permanently locking user accounts after a specific number of failed attempts until an administrator manually unlocks them. "Cluster Lockdown" (Option A) refers to disabling password authentication entirely in favor of SSH keys, which does not fit the requirement of locking accounts after incorrect login attempts.1

Here are the 100% verified answers for Questions 12, 13, 14, and 15, derived from Nutanix End User Computing architectural best practices.