CISSP Practice Question: Drag and drop the steps for a secure password…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Verify identity → Enter new password → Enforce password history → Hash storage → Log

  Why this is correct

  This order is correct because you first verify the user's identity through their old password, then allow them to enter a new password, check that the new password is not among recent ones (history enforcement), securely hash and store it, and finally log the change for auditing.

• ✗

  Verify identity → Enforce password history → Enter new password → Hash storage → Log

  Why it's wrong here

  This sequence is fundamentally flawed because 'Enforce password history' requires a candidate new password to be provided first. Without the user having entered their desired new password, the system has no input to compare against the historical records, rendering this step premature and impossible to execute effectively. The logical flow dictates that the new password must be received before any policy checks, including history enforcement, can be applied to it.

• ✗

  Enter new password → Verify identity → Hash storage → Enforce password history → Log

  Why it's wrong here

  This procedure introduces significant security vulnerabilities by allowing a user to 'Enter new password' before 'Verify identity.' An unauthorized individual could potentially change a password without proving ownership of the account, creating a critical bypass. Furthermore, 'Hash storage' occurring before 'Enforce password history' means the system might commit to storing a password that violates organizational policies, necessitating a rollback or re-prompt, which is inefficient and insecure.

• ✗

  Verify identity → Enter new password → Hash storage → Log → Enforce password history

  Why it's wrong here

  This is incorrect because password history enforcement must occur before storage; otherwise, the system may store a password that violates history rules. Also, logging before history check may log a change that is later rejected.

Go deeper

Related to this question