Study. uk . com
  1. Home
  2. All questions
  3. Question 262

CompTIA Security+ study material · question 262 of 611

A team proposes expanding its password blocklist to a billion entries. Why does NIST consider this of little additional benefit?

  1. Because large blocklists reject valid passphrases
  2. Because the blocklist defends against online guessing that rate limiting already constrains
  3. Because blocklists must be under a fixed size
  4. Because verification would become too slow
Show the answer

Answer: B. Because the blocklist defends against online guessing that rate limiting already constrains

The blocklist only needs to be big enough to catch what an attacker could try before the throttle stops them.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 3.1.1.2

Challenge yourself on this topic → Study as cards