CompTIA PBQ Practice Question - Password Policies - Security+, CySA+, CASP+ Network+

Security+ self-paced course 701 and 601 versions: cyberkrafttrai...
Security+ Bootcamp: cyberkrafttrai...
CySA+ Self-Paced Course: cyberkrafttrai...
CompTIA CySA+ Bootcamp: cyberkrafttrai...
Discounted Security+ Exam Voucher: cyberkrafttrai...
CompTIA CASP+ Course: cyberkrafttrai...
Check out all of our courses here: cyberkrafttrai...
Sign up for our Security+ Complete Self-Paced Course to study for and ace the exam on your own schedule: cyberkrafttrai...
For 10% off your enrollment use discount code: KZbinSP
The Cyberkraft Security+ Bootcamp will fully prepare you to ace the Security+ exam with 40 hours of live training with our CompTIA certified instructors:
cyberkrafttrai...
Ace your exam and earn an average yearly salary of $85,000.
Save $200 off of your enrollment with discount code: KZbin
Our bootcamp includes:
• 40 hours of live instruction over five days of instruction
• Exam fee included ($381 value)
• Expert instruction in all five domains
• Access to the Official CompTIA Security+ Learn and Labs Environment with PBQs, Labs, a digital textbook, and more
• Over 1000 pages of PDF study guides
• 12 practice tests and 6 simulation exams (500+ total questions) to fully prepare you for test day
• High definition video lessons accessible online or through the Cyberkraft App (included)
• Weekly study sessions and live support
• Lifetime access to all future course updates
• Second Shot Guarantee - If you don’t pass the first attempt, we will pay for your second exam
Sign up for our free video training on how to register and take the exam online: cyberkrafttrai...
Download our free ports and protocols reference sheet: cyberkrafttrai...
Cyberkraft is a CompTIA Authorized Partner, and ISACA Premium Accredited Training Organization, and an EC-Council Accredited Training Center.
Questions? E-mail: [[e-mail]]

[@derekarmstrong1408]

You're the 10th or 11th KZbinr I've followed, and the most easy to follow along with. You're doing a great job of demystifying this stuff. Thank you.

[@AJ-pq9mn]

Thank you for your videos, I passed my sec+ 701 today thanks to some of your PBQ’s.

[@cristianyepez1507]

On my way to take the sec+ exam!

[@cyberkraft1]

Good luck!

[@cristianyepez1507]

@@cyberkraft1 passed!!! Thank you so muchhh

[@MLH8789]

@@cristianyepez1507 Congrats! Taking mine in 3 weeks!

[@cristianyepez1507]

@@MLH8789 you got this!! Mine had a lot of acronyms

[@ironsilk6634]

Good 1 bro

[@SamadAli-rf1un]

Hi Dennis thanks for the PBQ content related to password policies for Security+ exams, currently I have security+ certification, and would like to know what is the difference between CompTIA Security+ and CompTIA SecurityX.

[@cyberkraft1]

The SecurityX is the new version of the CompTIA CASP+.

[@SamadAli-rf1un]

@@cyberkraft1 Thanks :)

[@RockMusicFanNo1]

I disagree with the false option (SMS OTP). Sim swapping is incredibly difficult as of 2024, unless you are a high ranking person in the organization or political landscape. For 99% of employees, SMS OTP should be fine. Similarly, it might be the only non costly method to provide free 2FA to a user, as most TOTP software is offered for free when you have already purchased or paid for paid solutions or services. Is SMS 2FA bad, and if so, should banks up their game in their customers’ account security and abolish it?

[@williamh7]

Some phone carriers, still allow user verification with last four of social security number. For some reason they won't change the policy and basically all of our socials, names, addresses have been leaked by multiple companies. Also, a bad phone carrier employee can easily do malicious activities.

[@RG_spc]

Bank example is for public hence very difficult to have all install authenticator app. That's done easily with employees, which is the exact use-case here. Nothing is probably 100% secure all the time for all cases. However, on balance of factors, I tend to agree with the authors of the video. From multiple experiences, employers commonly use Authenticators (Google, Microsoft, some even their own), whereas Banks use SMS. Is there a risk with banks using SMS? Yes. How do they address it? Multiple ways. Some banks also send email, some may even call up on suspected transactions (and ask security questions). That ssid, I've also seen banks use TOTP through their own mobile apps.

[@ancleasai]

SMS is vulnerable to SS7 attacks and it's use is deprecated in place of more secure alternatives. Sending SMS though low cost is not free

[@Euruzilys]

Singapore announced a ban on using SMS OTP for banking app. And if I remember correctly, Malaysia also has it banned too. So SMS OTP being considered insecure here is probably the right choice, and an up to date. Still, this is a CompTIA exam, so it’s gonna depend on them.