Question
The results of an internal audit indicate several employees reused passwords that were previously included in a published list of compromised passwords.
The company has the following employee password policy:
| Attribute | Requirement |
|---|---|
| Complexity | Enabled |
| Character class | Special character, number |
| Length | 10 characters |
| History | 8 |
| Maximum age | 60 days |
| Minimum age | 0 |
Which of the following should be implemented to best address the password reuse issue? (Choose two.)
- A. Increase the minimum age to two days. Correct
- B. Increase the history to 20. Correct
- C. Increase the character length to 12.
- D. Add case-sensitive requirements to character class.
- E. Decrease the maximum age to 30 days.
- F. Remove the complexity requirements.
- G. Increase the maximum age to 120 days.
Explanation
Password reuse is controlled by password history combined with a minimum password age. With a minimum age of 0, users can change their password several times in a row to cycle past the history and return to an old password; a minimum age above zero stops that, and a longer history of 20 remembers more previous passwords. Longer length or extra character classes make passwords harder to guess but do not prevent reusing an old one, and changing the maximum age or removing complexity does nothing for reuse.
