CCAK · Question #65
Which objective is MOST appropriate to measure the effectiveness of password policy?
The correct answer is D. The number of related incidents decreases. A password policy's effectiveness is measured by outcomes, not just compliance. Option D - a decrease in related incidents - directly measures whether the policy is achieving its security goal: reducing unauthorized access and credential-based breaches. Option C (newly created…
Question
Which objective is MOST appropriate to measure the effectiveness of password policy?
Options
- AThe number of related incidents increases.
- BAttempts to log with weak credentials increases.
- CNewly created account credentials satisfy requirements.
- DThe number of related incidents decreases.
How the community answered
(41 responses)- A2% (1)
- B2% (1)
- C5% (2)
- D90% (37)
Explanation
A password policy's effectiveness is measured by outcomes, not just compliance. Option D - a decrease in related incidents - directly measures whether the policy is achieving its security goal: reducing unauthorized access and credential-based breaches. Option C (newly created accounts meeting requirements) measures policy enforcement/compliance, not effectiveness. Options A and B describe worsening or ambiguous conditions. A strong policy should translate into fewer incidents over time, making D the only true effectiveness metric.
Topics
Community Discussion
No community discussion yet for this question.