A password policy forces changes every thirty days, and an audit finds users choosing predictable patterns such as a season plus the year. Which policy change BEST aligns with current password best practices?
Select an answer to reveal the explanation.
Short Explanation
Make people change passwords constantly and you'll get Spring2025, then Summer2025 - you trained them to be predictable. Current guidance flips it: go long, block the ones already in breach lists, and change only when there's a reason. Shortening the interval is the trap; it just speeds up the pattern.
Full Explanation
Current password guidance, reflected in widely adopted standards such as NIST's digital identity guidelines, moves away from frequent forced rotation and heavy composition rules. Those practices push users toward predictable transformations of a base word, which attackers model easily. Better outcomes come from favoring length, which increases resistance to guessing, screening new passwords against lists of known-compromised and commonly used values, and requiring a change when there is evidence of compromise rather than on an arbitrary schedule. Combined with compromised credential monitoring and MFA, this reduces the success of credential stuffing and guessing. Shortening the change interval intensifies the very behavior the audit found, generating more patterned passwords more quickly. Adding composition rules tends to produce passwords like a capitalized word followed by a digit and a symbol, which satisfies the rules without adding meaningful strength. Allowing reuse of previous passwords lets a compromised value return and undermines any rotation that does occur. Exam caveat: expiration and age settings still matter where regulations require them, but the objective tests the reasoning behind length, reuse, and compromise monitoring. Operational check: enable screening against a breached-password list, test that a known-breached value is rejected, and review the policy report for remaining expiration settings.