Password policies and best practices in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why are password complexity requirements important?

Which of the following best explains why password complexity requirements (such as including uppercase letters, numbers, and symbols) are important in password policies?

A They make passwords easier to remember for users.

B They ensure passwords are always at least 20 characters long.

C They allow users to reuse the same password across multiple accounts safely.

D They reduce the chance of passwords being guessed or cracked by attackers.

💡 Hint

Think about how attackers try to break passwords.

Password complexity makes it harder for attackers to guess or crack passwords by increasing the number of possible combinations.

📋 Factual

intermediate

What is the recommended minimum password length?

According to modern password best practices, what is the recommended minimum length for a secure password?

A At least 12 characters

B At least 8 characters

C At least 20 characters

D At least 6 characters

💡 Hint

Longer passwords are generally more secure.

Current guidelines recommend passwords be at least 12 characters long to resist brute-force attacks effectively.

🚀 Application

advanced

Which password policy reduces risk of password reuse across sites?

Which password policy best helps reduce the risk of users reusing the same password across multiple websites?

A Enforce password expiration every 30 days.

B Implement password history to prevent reuse of recent passwords.

C Require multi-factor authentication (MFA) for all accounts.

D Mandate passwords contain at least one special character.

💡 Hint

Think about how to stop users from using old passwords again.

Password history policies prevent users from reusing recent passwords, encouraging unique passwords for each account.

🔍 Analysis

advanced

What is the main drawback of frequent password changes?

What is a common negative effect of requiring users to change their passwords very frequently (e.g., every 30 days)?

A Users may write down passwords or use simpler ones, reducing security.

B It ensures passwords are always unique across all accounts.

C It completely eliminates the risk of password theft.

D Users tend to create stronger passwords each time.

💡 Hint

Consider user behavior when forced to change passwords often.

Frequent password changes can lead users to choose weaker passwords or write them down, which can reduce overall security.

❓ Reasoning

expert

Why is multi-factor authentication (MFA) considered a best practice alongside passwords?

Why is multi-factor authentication (MFA) recommended as a best practice in addition to strong passwords?

A Because MFA makes passwords shorter and easier to remember.

B Because MFA replaces the need for passwords entirely.

C Because MFA adds an extra layer of security, making it harder for attackers to gain access even if the password is compromised.

D Because MFA allows users to share passwords securely.

💡 Hint

Think about what happens if a password is stolen.

MFA requires an additional verification step beyond the password, so even if a password is stolen, attackers cannot access the account without the second factor.

Practice

1. Which of the following is a key characteristic of a strong password?

easy

A. It is a common word found in the dictionary.

B. It contains a mix of letters, numbers, and special characters.

C. It uses only your birthdate for easy recall.

D. It is shorter than 6 characters.

Solution

1. Step 1: Understand password strength criteria

   A strong password should mix letters, numbers, and special characters to increase complexity.

2. Step 2: Evaluate each option

   Options A, B, and D describe weak passwords that are easy to guess or too short.

3. Final Answer:

   It contains a mix of letters, numbers, and special characters. -> Option B

4. Quick Check:

   Strong password = mix of characters [OK]

Hint: Strong passwords mix letters, numbers, and symbols [OK]

Common Mistakes:

• Choosing simple or common words
• Using only numbers or letters
• Making passwords too short

2. Which password policy rule is correctly written?

easy

A. Passwords must be at least 8 characters long.

B. Passwords should be exactly 4 characters.

C. Passwords must contain only letters.

D. Passwords should never include numbers.

Solution

1. Step 1: Recall standard password length rules

   Most secure policies require passwords to be at least 8 characters for safety.

2. Step 2: Check each option against best practices

   Options A, C, and D contradict common security advice by limiting length or character types.

3. Final Answer:

   Passwords must be at least 8 characters long. -> Option A

4. Quick Check:

   Minimum length = 8 characters [OK]

Hint: Minimum password length is usually 8 or more [OK]

Common Mistakes:

• Setting passwords too short
• Restricting characters unnecessarily
• Ignoring numbers or symbols

3. Consider this password policy code snippet in Python:

def is_strong(password):
    return (len(password) >= 8 and
            any(c.isdigit() for c in password) and
            any(c.isalpha() for c in password) and
            any(not c.isalnum() for c in password))

print(is_strong("Pass123!"))
print(is_strong("password"))

What will be the output?

medium

A. True
False

B. False
True

C. True
True

D. False
False

Solution

1. Step 1: Analyze the first password "Pass123!"

   It has length 8, digits (1,2,3), letters (P,a,s,s), and special character (!), so returns True.

2. Step 2: Analyze the second password "password"

   It has letters only, no digits or special characters, so returns False.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Strong password check = True, weak password check = False [OK]

Hint: Check digits, letters, special chars for True [OK]

Common Mistakes:

• Ignoring special character check
• Assuming letters-only is strong
• Misreading length condition

4. A company enforces this password rule: "Passwords must include at least one uppercase letter, one lowercase letter, and one number." Which password violates this rule?

medium

A. Secure1

B. Secure123

C. secure123

D. S3curePass

Solution

1. Step 1: Check each password for uppercase, lowercase, and number

   secure123 has no uppercase letters, violating the rule.

2. Step 2: Confirm other options meet all criteria

   Options B, C, and D all have uppercase, lowercase, and numbers.

3. Final Answer:

   secure123 -> Option C

4. Quick Check:

   Missing uppercase letter = violating rule [OK]

Hint: Look for missing uppercase, lowercase, or digits [OK]

Common Mistakes:

• Overlooking missing uppercase letters
• Assuming numbers alone are enough
• Ignoring case sensitivity

5. An organization wants to improve account security by combining password policies with two-factor authentication (2FA). Which of the following best describes this approach?

hard

A. Using strong passwords alone is enough for security.

B. Using simple passwords with 2FA is the safest method.

C. 2FA replaces the need for strong passwords entirely.

D. Combining strong passwords with 2FA adds an extra security layer.

Solution

1. Step 1: Understand the role of strong passwords and 2FA

   Strong passwords protect against guessing, while 2FA adds a second verification step.

2. Step 2: Evaluate each option's security approach

   Combining strong passwords with 2FA adds an extra security layer, which correctly states that both improve security. Options A, B, and C misunderstand or weaken security.

3. Final Answer:

   Combining strong passwords with 2FA adds an extra security layer. -> Option D

4. Quick Check:

   Password + 2FA = stronger security [OK]

Hint: Strong password + 2FA = best protection [OK]

Common Mistakes:

• Thinking 2FA replaces passwords
• Relying on weak passwords with 2FA
• Ignoring multi-layer security benefits