ITPEC FE Morning October 2018 Question 41
ITPEC FE Morning October 2018 — Question 41 of 80
Password Reset Security — After identity verification, send a hard-to-guess reset URL to the user's pre-registered email.
The correct answer is c): Send a hard-to-guess URL to the user's pre-registered e-mail address so that the user can access a password reset page.
This is the most secure approach because:
- The reset URL is hard to guess (contains a random token), preventing brute-force attacks
- It is sent to the pre-registered email, confirming the recipient is the actual account owner
- The user sets a new password themselves — the current password is never transmitted
Why not the others:
- a) The user enters the email address manually — an attacker could enter their own email and receive the reset link
- b) Sends the current password to a user-entered email — passwords should never be stored or sent in plaintext, and the email is not verified
- d) Uses the correct (pre-registered) email, but sends the current password — passwords must never be transmitted in plaintext
Key rule: Never send the current password via email. Always use a one-time reset link sent only to a pre-registered (verified) email address.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.