SY0-701 Question 365
Single answerPassword best practicesA company is revising its password policy after a phishing campaign led to several account compromises. The security administrator wants to reduce user reuse of weak passwords without causing frequent lockouts or excessive help desk calls. Which policy change would BEST align with current password best practices for improving security and usability?
- A
Require users to change 8-character complex passwords every 30 days
- B
Increase the minimum password length to support long passphrases and screen new passwords against a banned password list
- C
Allow shorter passwords if users include at least one special character and one number
- D
Prevent users from pasting passwords into login fields so they must manually enter them each time
Show answer and explanation
Correct answer: B
Explanation
The best answer is to support long passphrases and check new passwords against a banned password list. This reflects modern password guidance from sources such as NIST SP 800-63B, which recommends screening passwords against commonly used, expected, or compromised values and avoids unnecessary periodic password changes unless there is evidence of compromise. NIST also discourages overly restrictive composition rules and practices that make password manager use harder, such as blocking paste. In a real environment, combining longer passwords, banned password screening, MFA, and user education provides stronger protection than relying on short, frequently changed passwords.
- A. Incorrect.
This is not the best choice. Frequent forced password changes for all users are no longer considered a strong default control because they often lead to predictable password patterns, minor variations, and increased help desk resets. An 8-character minimum is also weaker than modern guidance that favors longer passwords or passphrases.
- B. Correct.
This is the best answer. Current best practices emphasize allowing and encouraging longer passwords or passphrases and blocking commonly used, breached, or otherwise weak passwords through banned password screening. This improves resistance to guessing, credential stuffing, and brute-force attacks while avoiding the usability problems associated with frequent mandatory password rotation.
- C. Incorrect.
This is incorrect because it prioritizes composition rules over overall password strength. Short passwords with required character classes can still be weak and predictable, such as common base words with simple substitutions. Modern guidance favors length and screening against known weak passwords over rigid complexity requirements alone.
- D. Incorrect.
This is incorrect because preventing paste generally harms usability and can discourage the use of password managers, which are a recommended best practice. Password managers help users create and store unique, strong passwords, so blocking paste can reduce security rather than improve it.