CAS-005 · Question #177
A security audit of a company's application finds that customer account passwords are manually set and never expire. The company wants to fix the password issue on a minimal budget within 30 days…
The correct answer is C. Implement a self-service credential reset portal. Implementing a self-service credential reset portal allows customers to update their own passwords, addressing security concerns with minimal budget, quick implementation, and low customer impact.
Question
A security audit of a company's application finds that customer account passwords are manually set and never expire. The company wants to fix the password issue on a minimal budget within 30 days while minimizing the impact to customers. Which of the following should the company do?
Options
- AContact each user to reset their password.
- BMigrate authentication methods to allow for OAuth 2.
- CImplement a self-service credential reset portal.
- DConfigure a privilege access management solution.
How the community answered
(22 responses)- A5% (1)
- B9% (2)
- C77% (17)
- D9% (2)
Why each option
Implementing a self-service credential reset portal allows customers to update their own passwords, addressing security concerns with minimal budget, quick implementation, and low customer impact.
Manually contacting each user to reset their password would be a labor-intensive and expensive process, directly contradicting the 'minimal budget' and 'minimizing impact to customers' requirements.
Migrating to OAuth 2.0 is a significant architectural change that would likely exceed the 'minimal budget' and 'within 30 days' constraints, and involve substantial customer impact during the transition.
Implementing a self-service credential reset portal allows customers to securely reset their own manually set passwords, which is a cost-effective solution that can be deployed relatively quickly and minimizes direct disruption to customer accounts.
A privileged access management (PAM) solution is designed for managing administrative accounts and elevated privileges within an organization, not for customer-facing application password management.
Concept tested: User authentication and password management best practices
Source: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks
Community Discussion
No community discussion yet for this question.