easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Has implemented a password policy requiring a…
An organization has implemented a password policy requiring a minimum of 8 characters, including uppercase, lowercase, numbers, and special characters. Despite annual security awareness training, a recent audit revealed that 60% of employees are using passwords that can be cracked within hours. The organization is also experiencing a high number of account compromises due to credential stuffing attacks. The security team is considering various controls to reduce the risk. Which of the following would be the MOST effective in addressing the identified issues?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement multifactor authentication for all user accounts
Multifactor authentication (MFA) adds an additional layer of security that significantly reduces the risk of credential compromise, even if passwords are weak. Increasing password length may help but is still vulnerable to cracking if users choose predictable patterns. Password cracking tests are reactive and may not prevent attacks. Frequent password changes often lead to weaker passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the minimum password length to 15 characters
Why it's wrong here
While increasing minimum password length to 15 characters improves entropy against brute-force attacks, it does not inherently prevent users from choosing predictable patterns, reusing passwords across sites, or writing them down. Crucially, this measure offers no defense against credential stuffing attacks, where attackers utilize previously breached username/password pairs, as the length requirement is irrelevant if the exact credential pair is already known and valid.
- ✗
Conduct quarterly password cracking attempts and notify users with weak passwords
Why it's wrong here
Conducting quarterly password cracking attempts is a reactive security measure that identifies weak passwords post-facto, rather than preventing their initial creation or exploitation. While it helps identify vulnerabilities, it leaves the organization exposed to attacks leveraging those weak passwords for an entire quarter between assessments, and does not proactively address the root cause of weak password selection or external credential compromise.
- ✓
Implement multifactor authentication for all user accounts
Why this is correct
Implementing multifactor authentication (MFA) significantly enhances security by requiring users to provide two or more distinct verification factors (e.g., something they know, something they have, something they are). This creates a robust defense-in-depth mechanism, as even if an attacker compromises a user's password through credential stuffing or other means, they would still lack the second factor needed to gain unauthorized access, effectively mitigating the risk of password-only breaches.
- ✗
Require password changes every 30 days
Why it's wrong here
Requiring password changes every 30 days is a policy that often leads to counterproductive user behavior, as users tend to choose simpler, easily guessable passwords or minor variations of previous ones (e.g., 'Password1!', 'Password1@'). This practice makes them more susceptible to dictionary attacks or pattern-based cracking. Furthermore, this policy offers no protection against credential stuffing attacks, as the attacker is using a known, valid password from a different breach, irrespective of its age.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.