nerdexam
(ISC)2

CISSP · Question #506

Which inherent password weakness does a One Time Password (OTP) generator overcome?

The correct answer is D. Static passwords are easily disclosed. OTP generators address the core weakness of static passwords by producing a unique, time-limited credential for each authentication session, eliminating the risk of credential reuse after disclosure.

Submitted by tarun92· Mar 5, 2026Identity and Access Management

Question

Which inherent password weakness does a One Time Password (OTP) generator overcome?

Options

  • AStatic passwords must be changed frequently.
  • BStatic passwords are too predictable.
  • CStatic passwords are difficult to generate.
  • DStatic passwords are easily disclosed.

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    3% (1)
  • D
    87% (33)

Why each option

OTP generators address the core weakness of static passwords by producing a unique, time-limited credential for each authentication session, eliminating the risk of credential reuse after disclosure.

AStatic passwords must be changed frequently.

While frequent password changes are a security best practice, the need to change passwords frequently is a policy/management burden, not the primary inherent weakness that OTPs are specifically designed to counteract.

BStatic passwords are too predictable.

Predictability is a concern addressed by password complexity requirements and randomness policies, not the core problem OTPs solve; OTPs focus on eliminating credential reuse after exposure rather than improving password guessability.

CStatic passwords are difficult to generate.

Difficulty in generating strong passwords is addressed by password managers and generation tools, not OTP systems; OTPs do not exist to simplify password creation for users.

DStatic passwords are easily disclosed.Correct

Static passwords, once disclosed through phishing, shoulder surfing, data breaches, or interception, can be reused by an attacker indefinitely until changed. OTPs overcome this by generating a password valid for only a single authentication session or short time window, rendering any intercepted or disclosed credential immediately useless for subsequent login attempts.

Concept tested: One-Time Password purpose versus static password weaknesses

Source: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens

Topics

#One-time password (OTP)#password weakness#authentication factors#credential compromise

Community Discussion

No community discussion yet for this question.

Full CISSP Practice