Below are five multiple-select compliance questions for onboarding: Information Security & Password Policy. Each item focuses on password strength and password-sharing risks. For each question, select all options that apply.
- Which characteristics define a strong password or passphrase?
- A. At least 12 characters in length
- B. Unique for each system or account
- C. Common substitutions of dictionary words (e.g., P@ssw0rd, Summer2025!)
- D. A passphrase of unrelated words that may include spaces and punctuation
- E. Use of personal data (e.g., birthday, phone number, pet names)
Correct answers: A, B, D
Rationale: Strong secrets emphasize length, unpredictability, and uniqueness. Personal data and predictable substitutions are easily guessed or cracked.
- Which practices appropriately reduce the risk of password exposure or sharing?
- A. Use of an enterprise-approved password manager with a strong master password and MFA
- B. Storing passwords in a local text file or note for quick access
- C. Using SSO/federated login to minimize the number of separate passwords
- D. Keeping team credentials in a shared spreadsheet to ensure continuity
- E. Posting screenshots of credentials in a support ticket or chat for troubleshooting
Correct answers: A, C
Rationale: Approved password managers and SSO reduce exposure and reuse. Plaintext storage, shared documents, and posting credentials are prohibited and create high risk.
- Which actions constitute prohibited password sharing?
- A. Verbally telling your password to IT or a colleague so they can “check something”
- B. Entering your password on a coworker’s device to let them use your account
- C. Using an approved delegation or “grant access” feature to provide needed access without sharing your password
- D. Sending your password via encrypted chat to a manager for an urgent task
- E. Using a privileged access management workflow that grants time-bound access without revealing your password
Correct answers: A, B, D
Rationale: Passwords must never be disclosed or used by others. Use delegation or approved access workflows instead of sharing secrets.
- In which situations must you change your password immediately and report a potential incident?
- A. You entered your password on a suspected phishing page
- B. You typed your password on an untrusted/public device (e.g., kiosk)
- C. Your password appears in a compromised-credential alert or breach dataset
- D. You have not changed your password in 90 days but have no indication of compromise
- E. You shared your password once with a trusted coworker who says they deleted it
Correct answers: A, B, C, E
Rationale: Any suspected capture or disclosure requires immediate change and reporting. Time-based rotation without evidence of compromise, by itself, is not a trigger.
- Which statements align with current password policy best practices?
- A. Length and unpredictability provide more security than strict symbol-composition rules alone
- B. Mandating frequent password changes (e.g., every 30–60 days) is recommended even without signs of compromise
- C. New passwords should be screened against known-breached lists and blocked if found
- D. Reusing the same password across systems is acceptable if MFA is enabled
- E. Long passphrases that allow spaces are acceptable if supported by the system
Correct answers: A, C, E
Rationale: Emphasize length/unpredictability, breach screening, and passphrases. Forced periodic changes without cause and reuse (even with MFA) weaken security.
