5.3 Understand best practice security policies.
Objective 5.3 sits in Security Operations, which carries 18% of the Certified in Cybersecurity exam. The questions below are original, written from the official objective title above, and each explanation cites the ISC2 page it rests on.
Objective title verbatim from the official objectives. ISC2 exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A policy caps passwords at twenty characters, and a user's long passphrase is rejected. What should the policy allow?
Correct.
Concept
Length is where password strength actually lives, so a policy's ceiling matters as much as its floor: users choosing long passphrases must not be punished for it.
Why A
Maximum password length should be at least 64 characters to allow passphrases, per the guidance aligned with NIST SP 800-63B.
Now you: objective 5.3 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A user finds their login succeeds even when they mistype everything after the eighth character. Which policy rule was broken?
Sample question 2 of 3
A user's chosen password contains spaces and non-Latin characters, and the form rejects it. What does good policy say?
Sample question 3 of 3
Your team is scoping an MFA rollout by priority. Which accounts does guidance single out as requiring MFA?
Full Certified in Cybersecurity question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.