SY0-701 Question 369
Single answerPassword managersA security administrator is deploying a password manager for a hybrid workforce. Employees currently reuse passwords across multiple SaaS platforms, and several teams share credentials for a small number of legacy administrative accounts. Management wants to reduce credential reuse, improve auditing, and minimize the chance that a stolen vault password alone would expose all stored credentials. Which action should the administrator take FIRST to best meet these requirements?
- A
Require users to store their passwords in an encrypted spreadsheet protected by a long passphrase
- B
Deploy a password manager with unique generated passwords for each account, enable MFA on vault access, and use shared vaults or role-based sharing for team credentials
- C
Allow users to continue memorizing passwords for critical systems and only use the password manager for low-risk websites
- D
Implement periodic password rotation for all accounts but allow employees to keep using the same password pattern to make them easier to remember
Show answer and explanation
Correct answer: B
Explanation
The best answer is to deploy a password manager that generates unique passwords, protects vault access with MFA, and supports secure sharing for legacy or team-managed accounts. This aligns with common enterprise security practices and guidance from sources such as NIST SP 800-63B, which discourages predictable password behaviors and supports the use of password managers to reduce reuse and improve password strength. In a real environment, password managers also provide auditing, controlled sharing, and centralized administration features that encrypted files or memorization do not. MFA on the vault is especially important because it adds a second factor, reducing the likelihood that compromise of the master password alone will expose all stored credentials.
- A. Incorrect.
This is incorrect. Although an encrypted spreadsheet may seem better than plaintext storage, it lacks the centralized controls, auditing, secure sharing, autofill protections, password generation, and policy enforcement typically provided by a dedicated password manager. It also creates version-control and distribution problems in a business environment.
- B. Correct.
This is correct. A properly deployed password manager helps eliminate password reuse by generating unique passwords per account. Enabling MFA on the password manager vault reduces the risk that a stolen master password alone will grant access. Using shared vaults or role-based credential sharing for legacy team accounts improves accountability and avoids insecure practices such as emailing or messaging passwords. This approach directly addresses reuse, auditing, and protection of stored credentials.
- C. Incorrect.
This is incorrect. Limiting password manager usage to low-risk sites defeats much of the security benefit. Critical systems are exactly where strong, unique, and well-managed credentials are most important. Relying on memorized passwords for high-value accounts often leads to predictable reuse or weaker passwords.
- D. Incorrect.
This is incorrect. Password rotation by itself does not solve password reuse or weak password construction, especially if users follow predictable patterns such as incrementing a number or changing a season name. Modern best practices emphasize strong unique passwords, password managers, and MFA rather than forcing users into memorable but predictable schemes.