easyMultiple ChoiceObjective-mapped

CISA Has a policy requiring strong passwords Practice Question

An organization has a policy requiring strong passwords. Which additional control is most effective at preventing credential stuffing attacks?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Requiring multi-factor authentication (MFA) for all logins.

Multi-factor authentication (MFA) stops attackers who have stolen passwords because they cannot provide the second factor.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Increasing password length and complexity requirements.
Why it's wrong here
Strong passwords help against brute force but credential stuffing uses previously stolen passwords; MFA is more effective.
✗
Implementing account lockout after 3 failed attempts.
Why it's wrong here
Account lockout can slow attacks but attackers often spread attempts across many accounts to avoid lockout; MFA is stronger.
✓
Requiring multi-factor authentication (MFA) for all logins.
Why this is correct
MFA renders stolen passwords useless as the second factor is required for access.
✗
Conducting annual security awareness training.
Why it's wrong here
Training helps prevent users from reusing passwords but does not stop credential stuffing if passwords are already compromised.

Go deeper