CISSP · Question #506
Which inherent password weakness does a One Time Password (OTP) generator overcome?
The correct answer is D. Static passwords are easily disclosed. OTP generators address the core weakness of static passwords by producing a unique, time-limited credential for each authentication session, eliminating the risk of credential reuse after disclosure.
Question
Which inherent password weakness does a One Time Password (OTP) generator overcome?
Options
- AStatic passwords must be changed frequently.
- BStatic passwords are too predictable.
- CStatic passwords are difficult to generate.
- DStatic passwords are easily disclosed.
How the community answered
(38 responses)- A3% (1)
- B8% (3)
- C3% (1)
- D87% (33)
Why each option
OTP generators address the core weakness of static passwords by producing a unique, time-limited credential for each authentication session, eliminating the risk of credential reuse after disclosure.
While frequent password changes are a security best practice, the need to change passwords frequently is a policy/management burden, not the primary inherent weakness that OTPs are specifically designed to counteract.
Predictability is a concern addressed by password complexity requirements and randomness policies, not the core problem OTPs solve; OTPs focus on eliminating credential reuse after exposure rather than improving password guessability.
Difficulty in generating strong passwords is addressed by password managers and generation tools, not OTP systems; OTPs do not exist to simplify password creation for users.
Static passwords, once disclosed through phishing, shoulder surfing, data breaches, or interception, can be reused by an attacker indefinitely until changed. OTPs overcome this by generating a password valid for only a single authentication session or short time window, rendering any intercepted or disclosed credential immediately useless for subsequent login attempts.
Concept tested: One-Time Password purpose versus static password weaknesses
Source: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens
Topics
Community Discussion
No community discussion yet for this question.