FC0-U71 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Using a unique passphrase for each work account rather than reusing one password everywhere

  Why this is correct

  Unique credentials per account limit the damage of a breach: if one service is compromised, attackers cannot replay the same password against the employee's other work systems. This directly reduces credential-stuffing risk and is a foundational authentication practice, making it a correct choice for the policy the new employee must follow.

• ✗

  Storing passwords in a shared spreadsheet on the team's network drive so coworkers can cover for absences

  Why it's wrong here

  A shared spreadsheet exposes every credential to anyone with drive access and provides no accountability for who used which password. It also defeats the purpose of unique accounts, since actions cannot be traced to an individual. This practice increases risk and violates least-privilege and non-repudiation expectations, so it is not acceptable guidance.

• ✓

  Enabling multifactor authentication on the company email and code repository accounts

  Why this is correct

  Multifactor authentication requires something beyond a password, such as a code from an authenticator app, so a stolen password alone is insufficient to log in. Applying it to high-value accounts like email and source code repositories blocks many account-takeover attempts and is explicitly recommended by authentication guidance, making this a correct practice.

• ✗

  Reusing the same long passphrase across all work accounts because it is easier to remember

  Why it's wrong here

  Reuse means a single breach at any one service exposes every other account using that passphrase, a risk attackers exploit through credential stuffing. Length alone does not offset the danger when the same secret guards email, repositories, and administrative tools. Standard guidance calls for unique credentials per account, so this practice is incorrect.

• ✗

  Writing the passphrase on a sticky note attached under the laptop keyboard for quick reference

  Why it's wrong here

  Physically recording a passphrase near the device lets anyone with brief access to the laptop obtain the credential, including visitors or cleaning staff. It undermines the secrecy that authentication depends on and turns a strong passphrase into an easily discovered secret, so it contradicts standard credential-handling guidance and should not be followed.

Go deeper

Related to this question