Study. uk . com
  1. Home
  2. All questions
  3. Question 317

CISSP study material · question 317 of 500

A security team wants to expand its password blocklist to hundreds of millions of entries for extra safety. What does NIST SP 800-63B say about very large blocklists?

  1. They are counter-productive because they force users into predictable variations.
  2. They are required once the service exceeds a stated number of subscribers.
  3. They are acceptable only where passwords are used as a single factor.
  4. They add little, because the list defends against online attacks that rate limiting already constrains.
Show the answer

Answer: D. They add little, because the list defends against online attacks that rate limiting already constrains.

SP 800-63B notes excessively large blocklists give little incremental security benefit, since the blocklist defends against online attacks that are already limited by throttling requirements.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards