Study. uk . com
  1. Home
  2. All questions
  3. Question 259

CompTIA Security+ study material · question 259 of 611

A policy requires every password to contain an uppercase letter, a digit and a symbol. What is NIST's current guidance?

  1. Composition rules apply only to administrator accounts
  2. Composition rules replace the need for a blocklist
  3. Composition rules should be strengthened further
  4. Composition rules should not be imposed
Show the answer

Answer: D. Composition rules should not be imposed

Complexity rules push users toward predictable substitutions without adding real strength. A blocklist is the recommended control.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 3.1.1 Passwords

Challenge yourself on this topic → Study as cards