Password and Account Security
This domain tests how credentials are attacked, why length beats symbol complexity, how multi-factor authentication is classified, how accounts should be provisioned and removed, and what a user must do the moment credential compromise is suspected.
How passwords actually fail
- Guessing scales with length far more than with symbol count, so a long passphrase beats P@ssw0rd1.
- Credential stuffing replays passwords stolen from one breach against other services; the defenses are unique credentials and MFA.
- Password spraying tries one common password across many accounts to stay under lockout thresholds.
- Storage must use salted, slow hashing. Hashing is one-way and encryption is reversible, so an 'encrypted password database' is a red flag.
Factors and their strength
Something you know, something you have, something you are. Location and behavior are contextual signals, not strong factors. SMS one-time codes are better than nothing but exposed to SIM swap and interception. Push approvals are exposed to MFA fatigue and repeated prompts. FIDO2 authenticators and passkeys resist phishing because they are bound to the origin. No MFA stops an attacker who already holds a valid session cookie.
Account hygiene
- One account per person, no shared logins; service accounts documented and vaulted.
- Least privilege, separate administrative accounts, just-in-time elevation.
- Disable or delete on leaving and review access regularly.
- Rename, disable or change default and vendor accounts at installation.
- Auto-lock, session timeout, and no password saving in browsers on shared machines.
Worked example
A user reuses the same password on a shopping site and the corporate VPN. The shopping site is breached and the attacker logs into the VPN from an unusual country. The breach was not the company's, but the reuse created the exposure, so the missing controls are unique credentials and MFA, and the detection signal is impossible travel. The correct response is to force a reset, revoke active sessions, inspect the mailbox for new forwarding rules, and report through the incident process rather than quietly resetting.
Marks that are easy to lose
- Believing complexity is the main defense when length and breach screening matter more.
- Believing MFA makes phishing impossible; only origin-bound factors do.
- Confusing hashing with encryption.
- Assuming permanent lockout is ideal - it is a denial-of-service vector; throttling is preferred.