220-1102 Practice Question: A company's current password policy requires a…

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

Answer analysis

Why the other options are wrong

Understanding why incorrect options are tempting is as important as knowing the correct answer.

• ✗

  Reduce the minimum password length to 8 characters to make passwords easier to type

  Reducing length significantly decreases resistance to brute-force cracking, making it a security downgrade despite easing user memory.

• ✗

  Enforce password expiration every 30 days

  Frequent password changes often lead users to create weak, incremental passwords (e.g., 'May2024!, Jun2024!') and increase reset calls, without proportional security benefit.

• ✗

  Implement single sign-on with smart cards and PINs

  Smart card authentication is strong but requires purchasing readers, distribution, and management; it may reduce password burden but does not directly address the password complexity issue and adds cost.

Technical deep dive

How to think about this question

Allowing users to employ passphrases instead of highly complex, shorter passwords directly addresses the core problem of user burden and forgotten credentials while simultaneously bolstering security. Passphrases leverage length as their primary security mechanism, often consisting of multiple common words strung together (e.g., "correct horse battery staple"). This approach makes them significantly easier for humans to remember and type accurately compared to a seemingly random string of 14 characters with strict complexity rules. From a security standpoint, a long passphrase, even if composed of common words, can be far more resistant to brute-force and dictionary attacks than a shorter, complex password because the sheer number of possible combinations increases exponentially with length. Attackers would need to guess entire word sequences rather than just individual characters and symbols. This method directly contrasts with reducing the minimum password length to 8 characters, which would severely weaken security by making passwords much easier to crack, despite the perceived ease for users. Similarly, enforcing frequent password expiration (e.g., every 30 days) often backfires; users tend to create predictable, incremental passwords (like appending the current month or year) or write them down, leading to a net decrease in security and an increase in help desk calls, which is precisely what the company is trying to reduce. While implementing single sign-on with smart cards and PINs offers robust multi-factor authentication and could reduce password burden, it represents a significant infrastructure investment. It requires purchasing, distributing, and managing smart cards and readers for every user, along with the associated software and training. The question asks for an *alternative approach* to the *password policy* that enhances security and reduces user burden, implying a solution that modifies the existing password paradigm rather than replacing it with an entirely new, costly authentication system. Passphrases provide a cost-effective and user-friendly enhancement within the existing password framework.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

FAQ

Questions learners often ask

Keep practising

More 220-1102 practice questions

• →A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician…
• →A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A te…
• →A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobi…
• →A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication…
• →A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 1…
• →A company wants to allow employees to securely access internal resources from home via the internet. Which method provid…