City Guilds Model Questions Vol1 2019 Information Technology Question 1

A secure web service enforces the following password policy: passwords must be exactly \(8\) characters long and each character can be an uppercase letter (26), a lowercase letter (26), a digit (10) or one of \(10\) allowed special symbols, giving \(72\) possible symbols per position. The system locks an account for \(15\) minutes after \(5\) consecutive failed login attempts; the lockout timer resets after the lockout period. An attacker can try \(1000\) guesses per second but is limited by the lockout policy. Assuming users choose passwords uniformly at random from the allowed set, estimate the average time (in years) required for the attacker to compromise a single account. Then, if the attacker targets \(100\) different accounts simultaneously, what is the new average time to compromise any one of them? Give your final answer for the \(100\)-account scenario, rounded to two significant figures.