Which policy requires changing passwords after a defined period?

Which policy requires changing passwords after a defined period?

• A. Password history
• B. Password expiration
• C. Changing default usernames and passwords
• D. Enabling passwords

Answer: (B)

Password expiration is the policy that enforces changing passwords after a defined period. By setting a maximum password age, users must create a new password when the period ends, which limits how long a potentially compromised credential can be used. This helps reduce the risk from password breaches since old passwords become invalid after expiry. Other options address different protections: password history prevents reusing recent passwords, but doesn’t inherently require changes on a fixed schedule; changing default usernames and passwords is about removing factory defaults at setup; enabling passwords is not a period-based policy.

Password expiration is the policy that enforces changing passwords after a defined period. By setting a maximum password age, users must create a new password when the period ends, which limits how long a potentially compromised credential can be used. This helps reduce the risk from password breaches since old passwords become invalid after expiry.

Other options address different protections: password history prevents reusing recent passwords, but doesn’t inherently require changes on a fixed schedule; changing default usernames and passwords is about removing factory defaults at setup; enabling passwords is not a period-based policy.