ISC2 CC Access Controls Concepts Practice Question
According to NIST SP 800-63 recommendations for password policies, which THREE practices are recommended? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow users to paste passwords to facilitate password manager use
NIST SP 800-63 recommends checking passwords against breached lists, setting minimum length (8+ characters, 15+ for high assurance), and avoiding frequent forced changes unless compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Allow users to paste passwords to facilitate password manager use
Why this is correct
This supports use of password managers, which generate strong passwords.
- ✓
Check passwords against known breached password lists
Why this is correct
This prevents use of compromised passwords.
- ✗
Require complex combinations of uppercase, lowercase, numbers, and symbols
Why it's wrong here
Complexity is not emphasized; length is favored over complexity.
- ✗
Require frequent password changes every 30 days
Why it's wrong here
Frequent forced changes are discouraged unless there is evidence of compromise.
- ✓
Require a minimum length of 8 characters for most accounts
Why this is correct
8 characters is the minimum; 15+ is recommended for high assurance.
Go deeper
Related to this question
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.