easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Wants to implement a password policy that…
An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?
⚠ Common exam trap
The trap here is that many candidates cling to outdated complexity rules (Option D) or frequent rotation (Option C) because they were once considered security best practices, but NIST now prioritizes breach-checking and longer, memorable passwords over arbitrary composition and expiry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compare new passwords against a list of known compromised passwords
NIST SP 800-63B explicitly recommends checking passwords against a list of known compromised passwords (e.g., from previous breaches) rather than enforcing arbitrary complexity rules. This approach directly mitigates credential stuffing and dictionary attacks by rejecting passwords that have already been exposed, while avoiding user frustration from frequent changes or complex composition requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Compare new passwords against a list of known compromised passwords
Why this is correct
Comparing new passwords against a list of known compromised passwords, often referred to as a "blacklist" or "denylist," is a highly effective modern security practice. This method prevents users from selecting passwords that have already been exposed in data breaches, significantly mitigating the risk of credential stuffing attacks where attackers try known username/password combinations across multiple services. By proactively blocking weak or compromised credentials, organizations enhance their overall security posture without imposing burdensome complexity rules on users. This approach directly addresses the widespread problem of password reuse.
- ✗
Set maximum password length to 8 characters
Why it's wrong here
Setting a maximum password length of only 8 characters severely limits the entropy and strength of user passwords, making them highly susceptible to brute-force attacks. Modern recommendations, such as those from NIST, emphasize allowing users to create long passphrases, ideally with a minimum length of 8 characters and no practical maximum, often suggesting support for at least 64 characters. Restricting length forces users into weaker choices, directly undermining security by reducing the computational effort required for an attacker to guess or crack credentials.
- ✗
Require password changes every 30 days
Why it's wrong here
Requiring password changes every 30 days is an outdated and counterproductive security practice that NIST and other security bodies now advise against. Frequent mandatory changes often lead users to select weaker, more predictable passwords, such as sequential variations (e.g., "Password1," "Password2"), or to write them down, thereby diminishing actual security. Instead, password changes should only be enforced when there is evidence of compromise or a strong suspicion of unauthorized access, focusing on incident response rather than arbitrary schedules.
- ✗
Enforce a minimum of one uppercase, one lowercase, one digit, and one special character
Why it's wrong here
Enforcing rigid composition rules, such as requiring one uppercase, one lowercase, one digit, and one special character, is no longer recommended by leading security guidelines like NIST SP 800-63B. While seemingly increasing complexity, these rules often limit the overall character space and encourage predictable substitutions (e.g., "P@ssw0rd!") that are easily targeted by dictionary and pattern-based attacks. Prioritizing password length and uniqueness, rather than artificial complexity, is more effective for creating truly strong and memorable credentials.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.