5.4 Describe Security Password Policy Elements, Such as Management, Complexity, and Password Alternatives (multifactor Authentication, Certificates, and Biometrics) 200-301 Practice Questions (Page 7)

Questions 31–33

1. 31expert · hard

   A company is revising its authentication policy. The security team wants to reduce the risk of credential theft while minimizing user friction. The current policy requires a 10-character password with complexity, changed every 60 days. A recent audit found that 40% of users write passwords on sticky notes. The company also wants to implement MFA, but the budget only allows one new control. Which combination of changes would best achieve the security goal while addressing the root cause of the sticky-note behavior?

   • AKeep the 60-day rotation, increase password length to 14 characters, and implement MFA using SMS OTP.
   • BRemove forced rotation, require a 12-character passphrase, and implement MFA using an authenticator app.
   • CRemove forced rotation, keep the 10-character complexity requirement, and implement MFA using security questions.
   • DKeep the 60-day rotation, require a 12-character password with complexity, and implement MFA using hardware tokens.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company's password policy currently requires exactly 8 characters with at least one uppercase letter, one number, and one symbol. An auditor notes that users often choose predictable patterns like 'Password1!' and that the policy does not prevent common dictionary words. Which change would most effectively improve password strength while addressing the auditor's concern?

   • AChange the rotation period to 30 days so that any compromised password is valid for a shorter time.
   • BRequire that passwords contain the user's name or employee ID to make them easier to remember.
   • CIncrease the minimum length to 12 characters and add a check against a list of common passwords and dictionary words.
   • DRequire at least two symbols and two numbers while keeping the 8-character minimum.
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A healthcare organization has a mix of desktop users and mobile clinicians. The security policy mandates MFA for all access to patient data. Desktop users have smart cards, but mobile clinicians find smart cards impractical. The organization also has a strict budget and cannot afford new hardware tokens. They want to maintain a high level of security. Which solution best meets the needs of both groups?

   • AUse SMS-based one-time codes for mobile clinicians and keep smart cards for desktop users.
   • BUse a mobile authenticator app for all users, replacing smart cards.
   • CUse biometric fingerprint scanning on all devices, eliminating the need for smart cards or apps.
   • DKeep smart cards for desktop users and use a mobile authenticator app for mobile clinicians.
   Reveal Solution Discussion Select an answer first