easyMultiple ChoiceObjective-mapped
SSCP Ensure that employees use strong passwords Practice Question
A company wants to ensure that employees use strong passwords. Which policy is most effective?
⚠ Common exam trap
The trap here is that many candidates overvalue complexity (uppercase, numbers, symbols) because of legacy policies, but the ISC2 SSCP exam tests the modern NIST guidance that password length trumps complexity and periodic changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require a minimum password length of 12 characters.
Password length is the single most important factor in resistance to brute-force and rainbow table attacks. NIST SP 800-63B and industry best practices now recommend a minimum of 12–16 characters, as each additional character exponentially increases the keyspace. While complexity adds some entropy, a long passphrase is far more effective against modern GPU-based cracking than a short, complex password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Prohibit password reuse for the last 10 passwords.
Why it's wrong here
This is good but not as effective as length.
- ✗
Require password changes every 30 days.
Why it's wrong here
Frequent changes encourage weak passwords and reuse.
- ✓
Require a minimum password length of 12 characters.
Why this is correct
Length is the most important factor for password strength.
- ✗
Require a mix of uppercase, lowercase, numbers, and symbols.
Why it's wrong here
Complexity requirements can lead to predictable patterns.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.