ISC2 CC Access Controls Concepts Practice Question

Which of the following is a recommended practice for password security according to NIST SP 800-63?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a minimum of 8 characters and check against breached password lists

NIST SP 800-63 recommends favoring password length over complexity and checking passwords against breached lists.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Require frequent password changes every 30 days
Why it's wrong here
Frequent forced changes are no longer recommended unless compromised.
✓
Use a minimum of 8 characters and check against breached password lists
Why this is correct
Correct. Length is favored, and passwords should be checked against known breaches.
✗
Set maximum password age to 90 days
Why it's wrong here
Periodic changes are discouraged unless there is evidence of compromise.
✗
Enforce complex passwords with special characters
Why it's wrong here
Complexity is less important than length and breach checking.

Go deeper