Study. uk . com
  1. Home
  2. All questions
  3. Question 315

CISSP study material · question 315 of 500

A blocklist is being assembled for a new service. Which three sources does NIST SP 800-63B suggest it draw on? Choose three.

  1. Passwords obtained from previous breach corpuses.
  2. Context-specific words such as the service name and the username, with derivatives.
  3. Dictionary words.
  4. The organisation's list of departed employees' former passwords.
Show the answer

Answer: C. Dictionary words.
B. Context-specific words such as the service name and the username, with derivatives.
A. Passwords obtained from previous breach corpuses.

The examples given are breach corpuses, dictionary entries, and terms tied to the deployment such as the service's own name, the username and variants.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards