Which policy changes would help prevent passwords from being cracked within six hours?

Which policy changes would help prevent passwords from being cracked within six hours?

• A. Implement 2FA or MFA; User passphrases; No reuse of old passwords; No reuse of passwords on different applications.
• B. Change passwords every 30 seconds.
• C. Reuse the same password across applications.
• D. Disable password changes.

Answer: (A)

Preventing a cracked password from being used quickly hinges on layered defenses that require more than just a knowledge factor to authenticate. First, implementing 2FA or MFA adds a second factor the attacker would need to obtain or spoof, so even a stolen password often isn’t enough to gain access in a short window. This dramatically reduces the payoff of cracking a password. Second, using strong user passphrases increases the effort needed to guess or brute-force credentials. Longer, memorable phrases with proper entropy are far harder to crack quickly than short, simple passwords, making a successful compromise take much longer than six hours. Third, prohibiting reuse of old passwords and no reuse across applications minimizes the risk that a breach in one service leads to easy access on others. If stolen credentials can’t be reused, an attacker can’t immediately exploit a single leak across multiple sites. Why the other options don’t fit: changing passwords every 30 seconds is impractical and can lead to weaker practices; reusing the same password across apps creates a cascade of risk after any single breach; and disabling password changes removes the ability to rotate credentials after a suspected compromise, keeping access valid for longer.

Preventing a cracked password from being used quickly hinges on layered defenses that require more than just a knowledge factor to authenticate. First, implementing 2FA or MFA adds a second factor the attacker would need to obtain or spoof, so even a stolen password often isn’t enough to gain access in a short window. This dramatically reduces the payoff of cracking a password.

Second, using strong user passphrases increases the effort needed to guess or brute-force credentials. Longer, memorable phrases with proper entropy are far harder to crack quickly than short, simple passwords, making a successful compromise take much longer than six hours.

Third, prohibiting reuse of old passwords and no reuse across applications minimizes the risk that a breach in one service leads to easy access on others. If stolen credentials can’t be reused, an attacker can’t immediately exploit a single leak across multiple sites.

Why the other options don’t fit: changing passwords every 30 seconds is impractical and can lead to weaker practices; reusing the same password across apps creates a cascade of risk after any single breach; and disabling password changes removes the ability to rotate credentials after a suspected compromise, keeping access valid for longer.