SY0-701 Question 368
Single answerPassword managersA security administrator is rolling out a password manager to a hybrid workforce. The company wants to reduce password reuse, support unique complex passwords for hundreds of SaaS applications, and avoid creating a single point of compromise if an employee's workstation is infected with malware. Which implementation choice BEST meets these requirements?
- A
Deploy a password manager that stores each user's vault encrypted with a strong master password and require MFA to unlock the vault
- B
Store departmental passwords in a shared spreadsheet on an encrypted network share and protect the file with NTFS permissions
- C
Configure browsers to save passwords locally so users do not need to remember a separate master password
- D
Issue one complex password per employee and require users to rotate that same password across all SaaS applications every 30 days
Show answer and explanation
Correct answer: A
Explanation
The best implementation is a password manager that stores credentials in an encrypted vault protected by a strong master password, with MFA required for access. This supports unique complex passwords at scale and is far more secure than spreadsheets, browser-only storage, or reused passwords. In Security+ terms, password managers help improve authentication security by reducing password reuse and enabling stronger credentials without increasing the memorization burden on users. Guidance from organizations such as NIST SP 800-63B supports the use of password managers and discourages practices like unnecessary forced password rotation and password reuse. While no solution fully eliminates risk from malware on an infected endpoint, adding MFA and using a dedicated password manager with strong access controls is the best choice among the options provided.
- A. Correct.
This is the best answer. A properly implemented password manager allows users to maintain unique, complex passwords for many applications without memorizing each one. Encrypting the vault with a strong master password helps protect stored credentials, and requiring MFA to unlock or access the vault adds another layer of protection if the workstation or the user's primary credential is compromised. This aligns with common security best practices and modern guidance favoring password managers to reduce reuse and improve credential hygiene.
- B. Incorrect.
This is incorrect. Although an encrypted network share and file permissions provide some protection, a shared spreadsheet is not an appropriate password management solution. It does not provide secure per-entry controls, auditing, safe sharing workflows, or the same level of encryption and access management expected from a password manager. It also encourages insecure operational practices and becomes a high-risk repository of credentials.
- C. Incorrect.
This is incorrect. Browser-based password storage can be convenient, but using only locally saved browser passwords does not best meet the requirement to avoid a single point of compromise when a workstation is infected with malware. Browser stores are often less suitable for enterprise governance, secure sharing, centralized policy enforcement, and stronger access controls than a dedicated password manager. This option also does not address stronger vault-level protections such as a master password combined with MFA.
- D. Incorrect.
This is incorrect. Reusing one password across multiple SaaS applications is exactly what the company is trying to eliminate. Frequent password rotation of the same password pattern across systems increases user burden and often leads to weaker password habits. Current best practices emphasize unique passwords per service and avoiding unnecessary periodic password changes unless there is evidence of compromise.