Study. uk . com
  1. Home
  2. All questions
  3. Question 316

CISSP study material · question 316 of 500

A service rejects a blocklisted password with a generic failure message and no further help. Which two things does NIST SP 800-63B require or recommend instead? Choose two.

  1. Assign a random password rather than allowing another attempt.
  2. Tell the subscriber the reason the password was rejected.
  3. Lock the account for ten minutes after a blocklist rejection.
  4. Offer guidance on choosing a strong password, especially after a blocklist rejection.
Show the answer

Answer: B. Tell the subscriber the reason the password was rejected.
D. Offer guidance on choosing a strong password, especially after a blocklist rejection.

The subscriber must be told why and required to choose another, and guidance must be offered, which discourages a trivial edit of the rejected value.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards