Study. uk . com
  1. Home
  2. All questions
  3. Question 320

CISSP study material · question 320 of 500

A legacy banking portal asks for the third, fifth and ninth characters of a customer's password, and silently ignores anything beyond 20 characters. Which two requirements of NIST SP 800-63B does this violate? Choose two.

  1. The verifier must accept only printing ASCII characters.
  2. The verifier must request the password in full rather than a subset of it.
  3. The verifier must require a minimum of 15 characters for any password.
  4. The verifier must verify the entire submitted password without truncating it.
Show the answer

Answer: B. The verifier must request the password in full rather than a subset of it.
D. The verifier must verify the entire submitted password without truncating it.

SP 800-63B requires the password to be provided in full, not a subset, and the entire submitted password to be verified rather than truncated.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards