FirstTry

Objective 5.4

200-301

Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics).

Objective 5.4 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.

Objective title verbatim from the official objectives. Cisco exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

5-4Security Fundamentals

A cloud-only user enters the same wrong password twelve times in a row and is never locked out. The tenant runs the default lockout threshold. What explains this?

The lockout counter ignores repeats of the same bad passwordCorrect · your answerCorrect. A repeated string never advances the counter.
Password protection blocked the entry before the counter ranBanned password checks reject weak choices at password change time. A sign-in with a wrong password travels a different path.
The lockout duration expired between each pair of attemptsDuration governs how long a lock lasts once one starts. Here no lock ever started, so there was nothing to expire.
The threshold counts only sign-ins from unfamiliar locationsLocation is a risk signal rather than an input to lockout counting. Unfamiliar sign-in properties matter to a Conditional Access policy.

Correct.

Checked against learn.microsoft.com, August 2026

Concept

A lockout counter exists to stop guessing, and guessing means trying new candidate strings. Repeating one wrong string tells an attacker nothing new, so a smart implementation keeps recent hashes and declines to count the same miss twice.

Why A

Microsoft Entra smart lockout keeps hashes of the three most recent bad passwords. A repeat of one of those does not advance the counter, so twelve identical tries never reach the ten attempt default and no lock is applied.

Source

Smart lockout tracks the last three bad password hashes to avoid incrementing the lockout counter for the same password. If someone enters the same bad password multiple times, they aren't locked out.

Microsoft Learn: Password policies and account restrictions in Microsoft Entra ID, checked August 2026
#password-policy#account-lockout#authentication

Now you: objective 5.4 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 2

5-4Security Fundamentals

A security team reviews a policy that forces password changes every 60 days and mandates mixed character types. Under NIST SP 800-63B, what should they change?

Sample question 2 of 2

5-4Security FundamentalsChoose 2

An organization rewrites the password rules for a new self service portal and must align them with NIST. Which two rules belong there? (Choose two.)

That’s 2 of the full CCNA bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Fundamentals