Password Security

Question 1 of 6

A security administrator compares two password options: Option A is an 8-character password using uppercase, lowercase, numbers, and special characters. Option B is a 16-character password using only lowercase letters. Which option provides higher entropy, and why?

Option A — using all four character categories creates a significantly larger character set, always producing higher entropy than longer passwords with fewer character types Option B — length contributes more dramatically to entropy than character set size; 26⊃16 (lowercase only, 16 chars) produces significantly more combinations than 94⊃8 (full character set, 8 chars) They are equal — the NIST standard specifies that character complexity and length contribute equally to password entropy Option A — special characters each contribute the equivalent of 2 additional characters of length to entropy calculations

Question 2 of 6

An organization has a 90-day password expiration policy with no password history requirement. Users frequently change their password to Summer2024! in June, then to Fall2024! in September. What problem does this illustrate, and which policy addition would BEST address it?

This illustrates credential stuffing risk; the solution is to enforce MFA on all accounts This illustrates predictable password patterns driven by mandatory expiration; adding a password history requirement (e.g., 24 previous passwords) prevents direct reuse and the predictable +1 pattern, while also considering whether expiration is still needed with MFA This illustrates weak character complexity; require at least 3 special characters to prevent season-year patterns This is an acceptable security posture; seasonal password changes are common and meet basic security requirements

Question 3 of 6

An employee uses the same password (Password123!) for their corporate email, personal Gmail, banking account, and five other services. A breach at one of the smaller services exposes this password. What attack can now target all the employee's accounts, and what technology would have prevented this from being a multi-account problem?

Brute-force attack; the solution is to enforce minimum password length of 16 characters Credential stuffing attack — attackers use stolen credential lists to attempt authentication on unrelated services; a password manager generating unique passwords for every account would have prevented reuse and limited breach impact to one service Dictionary attack; the solution is to require special characters and numbers to make passwords non-dictionary-word based Phishing attack; the solution is security awareness training to help the employee recognize credential harvesting emails

Question 4 of 6

A Privileged Access Management (PAM) system requires a server administrator to submit a ticket with a maintenance window, manager approval, and specific change reason before granting temporary root credentials. The credentials automatically expire after 2 hours. Which security concept is this implementing?

Password vaulting — the vault stores the root credential and proxies the administrator's session without revealing the password Just-in-time (JIT) permissions — elevated access is granted only when specifically needed, validated by a clearinghouse, and expires automatically, implementing least privilege at a time-based granularity Password expiration — the 2-hour validity period represents an aggressive password rotation schedule for privileged accounts Role-based access control — the administrator's role grants temporary access based on group membership in the maintenance team

Question 5 of 6

An organization uses a privileged access solution where database administrator credentials are stored in a centralized vault. When a DBA needs to access a production database, they authenticate to the vault, which then establishes the session on their behalf. The DBA never sees the actual database password, and the credential is automatically rotated after each use. Which technology is this?

Just-in-time permissions — the vault grants temporary elevated credentials for the duration of the session Password vaulting — primary privileged credentials are stored securely; the vault proxies sessions so the human administrator never sees the actual password; automatic rotation ensures credentials change after each use Enterprise password manager — the DBA's password is stored in a team password manager that all DBAs can access Passwordless authentication — the DBA authenticates using biometrics, and the system uses the biometric as the database credential

Question 6 of 6

A user authenticates to their laptop using facial recognition. The laptop uses a TPM chip to store the cryptographic key and Windows Hello to process the biometric. No password is entered. Which authentication paradigm is this, and how does it maintain security without a traditional password?

Single Sign-On — the laptop SSO session grants access to all connected systems without requiring a password after the first login Passwordless authentication — the biometric (something you are) validates against a cryptographic key stored in the TPM (something you have), providing MFA without a traditional password; the private key never leaves the TPM chip Biometric-only authentication — the facial scan alone authenticates the user; no second factor is involved Smart card authentication — the TPM chip functions as a smart card embedded in the laptop that stores the user's identity certificate

Matching

Match each description to the correct password security concept.

1. A software application that generates, stores, and retrieves strong unique passwords for every account, encrypting them with a master password so only one credential must be memorized

2. A measure of password unpredictability determined by the character set size and password length; longer passwords and larger character sets produce higher values

3. A privileged access model where elevated credentials are granted only when a specific task requires them, validated by a clearinghouse, with credentials expiring automatically after a short TTL

4. A security control that stores the last N passwords and prevents users from reusing any of them when they change their password, preventing predictable sequential password patterns

1. 2. 3. 4.

A. Password manager

B. Password entropy

C. Just-in-time (JIT) permissions

D. Password history

Password Security — Quiz

Matching