SY0-701 Question 367
Single answerPassword concepts: Length , Complexity , Reuse , Expiration , AgeA security administrator is updating the password policy for a company after an internal audit found that employees frequently reuse old passwords and choose short passwords with predictable substitutions, such as P@ssw0rd1. The company wants to reduce the likelihood of password guessing and credential-stuffing attacks while avoiding unnecessary user frustration caused by frequent forced password changes. Which policy change BEST addresses these concerns?
- A
Require 16-character minimum passwords, block reuse of the last 24 passwords, and only require password changes when compromise is suspected or confirmed
- B
Require 8-character passwords with upper, lower, number, and symbol complexity, and force password changes every 30 days
- C
Allow 12-character passwords without complexity requirements, permit reuse after 3 password changes, and expire passwords every 15 days
- D
Require users to change passwords every 7 days and prevent them from using any password older than 90 days
Show answer and explanation
Correct answer: A
Explanation
The best answer is the policy that emphasizes strong password length, prevents reuse, and avoids arbitrary expiration. Current best practices, including NIST SP 800-63B Digital Identity Guidelines, favor longer passwords and screening against weak or compromised choices rather than frequent forced changes. Password complexity alone is less effective than increasing length, especially when users respond with predictable substitutions. Password reuse controls are important because reused passwords increase exposure to credential-stuffing attacks across systems. Password expiration should generally be tied to suspected compromise, administrative reset, or other specific risk events rather than a fixed schedule, because routine expiration often reduces security in practice.
- A. Correct.
This is correct. A longer minimum length significantly improves resistance to guessing and brute-force attacks, and blocking reuse of many previous passwords helps prevent users from cycling back to familiar choices. Requiring changes only when compromise is suspected or confirmed aligns with modern guidance, such as NIST SP 800-63B, which discourages arbitrary periodic password expiration because it often leads to weaker password behavior and predictable variations.
- B. Incorrect.
This is incorrect. While complexity rules can help somewhat, an 8-character minimum is weaker than a much longer password requirement, and forcing password changes every 30 days is no longer considered a best practice for general use unless there is evidence of compromise. Frequent expiration often causes users to make small, predictable changes, which was one of the audit findings.
- C. Incorrect.
This is incorrect. Allowing 12-character passwords is better than very short passwords, but permitting reuse after only 3 changes undermines the goal of preventing password reuse. Expiring passwords every 15 days would create substantial user burden and commonly results in incremental changes rather than stronger passwords. Removing complexity can be acceptable in some frameworks when length is strong and screening controls exist, but this option weakens the policy overall because of the reuse and expiration settings.
- D. Incorrect.
This is incorrect. Forcing changes every 7 days is excessively burdensome and is likely to increase insecure user behavior such as writing passwords down or making trivial modifications. The phrase about preventing use of any password older than 90 days does not solve the core problems of weak length and predictable changes, and it reflects a misunderstanding of password age controls.