ISC2 CC Access Controls Concepts Practice Question

Which THREE are best practices for password management according to modern guidelines? (Select THREE.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enforce a minimum password length of 8 characters

Modern guidelines (NIST SP 800-63) recommend length over complexity, no frequent changes, and checking against breach lists.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enforce a minimum password length of 8 characters
Why this is correct
Length is favored over complexity; 8+ is minimum.
✓
Use a password manager to generate and store complex passwords
Why this is correct
Password managers encourage strong, unique passwords.
✗
Require at least one uppercase, one lowercase, one digit, and one special character
Why it's wrong here
Complexity requirements are less emphasized; length is more important.
✓
Check passwords against lists of known compromised passwords
Why this is correct
Breach checking prevents use of common passwords.
✗
Require passwords to be changed every 30 days
Why it's wrong here
Frequent changes are discouraged unless compromised.

Go deeper