220-1102 Question 473
Single answerPassword considerationsA small accounting firm recently failed a security review because several users were sharing credentials and using passwords such as Company2024! and Winter2025!. The IT technician must improve password security without causing major workflow disruption. Which action would BEST address the audit finding while following current password best practices?
- A
Require each employee to have a unique account and enforce long passphrases, changing them only when there is evidence of compromise or a policy-driven need
- B
Set a policy requiring all users to change passwords every 7 days and reduce the minimum length so employees can remember them more easily
- C
Create one departmental account with a highly complex password and rotate it monthly so the team can continue sharing access securely
- D
Allow users to keep simple passwords if they add a special character and store the passwords on sticky notes in a locked desk
Show answer and explanation
Correct answer: A
Explanation
The best answer is to assign unique accounts and require strong passphrases. In real-world environments, password security is not just about complexity rules; it also includes accountability, resistance to guessing, and practical usability. Shared accounts violate basic security principles because administrators cannot reliably audit who performed an action. Modern best practices, including NIST SP 800-63B guidance, emphasize longer memorable passwords or passphrases, blocking weak/common passwords, and avoiding overly frequent forced password changes unless there is a specific reason such as compromise. CompTIA A+ Core 2 expects technicians to recognize password considerations such as uniqueness, complexity versus length, secure handling, and the risks of credential sharing.
- A. Correct.
Correct. Unique user accounts provide accountability and prevent credential sharing, which is a major audit and security concern. Long passphrases are easier for users to remember and generally stronger than short complex passwords. Current best practices, including guidance reflected in NIST password recommendations, favor screening against weak/common passwords and avoiding unnecessary frequent password changes unless there is suspected compromise, a reset event, or an organizational requirement.
- B. Incorrect.
Incorrect. Frequent mandatory password changes can lead users to create predictable patterns, such as incrementing numbers or seasons, which weakens security in practice. Lowering minimum length also reduces password strength. This option reflects an outdated approach that often increases user frustration without meaningfully improving protection.
- C. Incorrect.
Incorrect. Shared departmental accounts eliminate accountability because actions cannot be tied to a specific user. Even if the password is complex and rotated regularly, shared credentials remain a poor security practice for normal user access. The scenario specifically identifies credential sharing as part of the problem.
- D. Incorrect.
Incorrect. Adding a special character to a simple password does not make it sufficiently strong if the password remains predictable. Writing passwords on sticky notes is also risky, even if the desk is locked, because it increases the chance of unauthorized disclosure. This option attempts to balance usability and security but does so in an unsafe way.