ITPEC IP April 2019 Question 37

A business-system password should not be reused for private Internet services — if a private service leaks it, attackers can try it on the business system.

Attackers take lists of IDs and passwords stolen from one website and try them on other services, a list-based attack (credential stuffing). A password used only for the business system cannot be exposed by a leak elsewhere, so the damage stays confined to one service.

Answer (a)

Why not others:

• •(b) — an initial password may be known to the administrator, sent on paper or easy to guess, so it should be changed at the first login
• •(c) — rotating through a few passwords brings old ones back, so a password leaked earlier becomes valid again
• •(d) — a plaintext file can be read by anyone who uses the PC and by any malware on it

Key rule: Reusing a password turns one site's leak into a breach of every account that shares it; use a different password per service, kept in a password manager rather than a plain file.

Security · AI-written, may contain errors