Which two security measures can help block password brute force attacks? $($Choose two.$)$

Use multiple authentication servers.

Implement account lockout after a number of bad guesses.

Specify a minimum length of a password, such as $8$ to $12$ characters.

Specify a maximum length of a password, such as $8$ to $12$ characters.

Implement password complexity, such as all upper case characters in the password.