Which of the following is the main reason for setting up password expiry policies?

The primary security reason for implementing password expiry policies is to mitigate the risk associated with compromised credentials. If a password is stolen or exposed in a data breach, an expiry policy limits the time window during which an attacker can use it to gain unauthorized access. By forcing a password change after a set period, the policy renders the stolen credential useless, thus reducing the overall window of vulnerability for the account.

A. Preventing password reuse is the function of a password history policy, not an expiry policy.
C. Password expiry is a control used within password-based authentication; it does not promote or force passwordless methods.
D. Password strength and complexity are enforced by separate complexity policies that dictate character requirements.

1. National Institute of Standards and Technology (NIST). (June 2017). Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management. Section 5.1.1.2

"Memorized Secret Verifiers". While NIST now advises against periodic password changes without evidence of compromise

it acknowledges the traditional rationale: "The idea behind this practice is to limit the exposure time if the password is stolen."

2. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. Chapter 4

"Authentication

" discusses password policies

explaining that password aging/expiration is a control to counter the threat of password cracking or theft over time.

3. University of California

Berkeley

Information Security Office. Minimum Security Standards for Passwords. The policy rationale often states that regular changes limit the damage from an undetected compromise.