SSCP Access Controls Practice Question
An organization is implementing a password policy that requires passwords to be at least 12 characters, include uppercase, lowercase, digits, and special characters, and be changed every 90 days. Additionally, users cannot reuse any of the last 10 passwords. Which password policy element does the last requirement address?
⚠ Common exam trap
The trap is confusing password history with password expiry or complexity; candidates might think 'cannot reuse' relates to expiry, but it's specifically about remembering past passwords.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password history
The requirement that users cannot reuse any of the last 10 passwords is specifically addressing password history, which prevents users from cycling back to previous passwords. This element enforces a memory of past passwords to avoid reuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password expiry
Why it's wrong here
Password expiry governs how long a credential remains valid before forced replacement, so it addresses the 90-day rotation clause, not reuse. It is tempting because expiry and history both limit password lifespan, but expiry sets a time limit whereas the last-10 rule blocks previously used values.
- ✗
Password length
Why it's wrong here
Password length sets the minimum number of characters a credential must contain, which the 12-character clause already covers. It is tempting because both are composition constraints, but length governs how long a password is, while the last-10 rule governs which prior passwords may be reused.
- ✓
Password history
Why this is correct
Password history enforces the no-reuse constraint by storing hashes of prior passwords and rejecting any new one matching the last 10 entries. This directly satisfies the stem's requirement that users cannot reuse recent passwords, distinct from complexity, length, or expiry settings.
- ✗
Password complexity
Why it's wrong here
Complexity governs the character mix required in a password, not history restrictions. It is tempting because both are policy settings, but complexity is the correct answer when the requirement mandates uppercase, lowercase, digits and symbols rather than preventing reuse of previous passwords.
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.