SY0-301 · Question #432
An insurance company requires an account recovery process so that information created by an employee can be accessed after that employee is no longer with the firm. Which of the following is the…
The correct answer is C. Authorized employees have the ability to reset passwords so that the data is accessible. The best account recovery approach for departed employees is allowing authorized staff to reset passwords, maintaining security without storing credentials in recoverable or shared form.
Question
An insurance company requires an account recovery process so that information created by an employee can be accessed after that employee is no longer with the firm. Which of the following is the BEST approach to implement this process?
Options
- AEmployee is required to share their password with authorized staff prior to leaving the firm
- BPasswords are stored in a reversible form so that they can be recovered when needed
- CAuthorized employees have the ability to reset passwords so that the data is accessible
- DAll employee data is exported and imported by the employee prior to them leaving the firm
How the community answered
(37 responses)- A14% (5)
- B5% (2)
- C73% (27)
- D8% (3)
Why each option
The best account recovery approach for departed employees is allowing authorized staff to reset passwords, maintaining security without storing credentials in recoverable or shared form.
Requiring employees to share passwords violates the principle of non-repudiation and is a direct security policy violation, as passwords are meant to be known only by the individual user.
Storing passwords in reversible (plaintext or reversibly encrypted) form is a critical security vulnerability that exposes all user credentials to theft if the password store is compromised.
Allowing authorized administrators to reset passwords is the most secure and operationally sound approach. It preserves the one-way hashing of stored passwords, requires no sharing of credentials, and provides a controlled, auditable process for accessing data after an employee's departure without compromising overall security posture.
Relying on the departing employee to export data introduces risk of data theft, incomplete transfer, or sabotage, and is not a reliable or secure process.
Concept tested: Secure account recovery and credential management
Source: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks
Topics
Community Discussion
No community discussion yet for this question.