nerdexam
CompTIA

SY0-301 · Question #433

A small company has a website that provides online customer support. The company requires an account recovery process so that customers who forget their passwords can regain access. Which of the…

The correct answer is D. Web-based form that identifies customer by another mechanism, sets a temporary password and forces. The best customer password recovery process identifies the user through an alternative mechanism, sets a temporary password, and forces a change on first use - avoiding transmission of actual passwords.

Security operations

Question

A small company has a website that provides online customer support. The company requires an account recovery process so that customers who forget their passwords can regain access. Which of the following is the BEST approach to implement this process?

Options

  • AReplace passwords with hardware tokens which provide two-factor authentication to the online
  • BRequire the customer to physically come into the company's main office so that the customer can be
  • CWeb-based form that identifies customer by another mechanism and then emails the customer their
  • DWeb-based form that identifies customer by another mechanism, sets a temporary password and forces

How the community answered

(58 responses)
  • A
    3% (2)
  • B
    3% (2)
  • C
    10% (6)
  • D
    83% (48)

Why each option

The best customer password recovery process identifies the user through an alternative mechanism, sets a temporary password, and forces a change on first use - avoiding transmission of actual passwords.

AReplace passwords with hardware tokens which provide two-factor authentication to the online

Hardware tokens are an authentication enhancement, not an account recovery mechanism, and are impractical for external online customers who have no pre-issued token.

BRequire the customer to physically come into the company's main office so that the customer can be

Requiring physical presence is operationally impractical for an online customer support system and does not scale for a web-based service.

CWeb-based form that identifies customer by another mechanism and then emails the customer their

Emailing the customer their actual password implies passwords are stored in recoverable (non-hashed) form, which is a serious security vulnerability and violates best practices.

DWeb-based form that identifies customer by another mechanism, sets a temporary password and forcesCorrect

This approach follows security best practices by never transmitting or revealing the original password. Using an alternative identification mechanism (such as security questions or a registered email) verifies identity, and forcing a password change after using the temporary credential ensures the temporary password cannot be reused if intercepted, minimizing the window of exposure.

Concept tested: Secure web-based password recovery with temporary credentials

Source: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html

Topics

#password recovery#temporary passwords#web authentication#account management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-301 Practice