You have installed the validate_password plug-in and set the validate_password_policy variable. Which validation is affected by the validate_password_policy setting?

Question

Options

• Awhether a new password is rejected if it contains a word found in a dictionary file.
• Bwhether a new password is rejected if it contains the current user's username.
• Cthe amount of delay after an incorrect password is entered
• Dthe length of time before a newly created password expires

• A
  88% (21)
• B
  8% (2)
• D
  4% (1)

Explanation

Option A is correct because validate_password_policy is set to one of three levels - LOW, MEDIUM, or STRONG - and only the STRONG level enables dictionary file checking, where new passwords are rejected if they contain words from a configured dictionary file. This dictionary check is the defining feature that distinguishes STRONG from the lower policy levels.

Why the others are wrong:

• B is wrong because username-based rejection is controlled by the separate variable validate_password_check_user_name, not by the policy level itself.
• C is wrong because login delay after failed attempts is handled by the connection_control plugin, which is entirely separate from validate_password.
• D is wrong because password expiration is governed by default_password_lifetime or ALTER USER ... PASSWORD EXPIRE, not by the validate_password plugin at all.

Memory tip: Think of the three policy levels as a ladder - LOW checks only length, MEDIUM adds character complexity rules, and STRONG adds the dictionary (a strong password can't be found in a book). If the question mentions a dictionary file, the answer lives at the STRONG policy level.

No community discussion yet for this question.