Which policy controls how many unique passwords a user must create before reusing a previous one?

Which policy controls how many unique passwords a user must create before reusing a previous one?

• A. Audit Logging
• B. Password History
• C. Minimum Age
• D. Multifactor Authentication (MFA)

Answer: (B)

Controlling how many unique passwords a user must create before reusing a previous one is achieved by a password history policy. This policy remembers a set of a user’s past passwords (often stored as salted hashes) and prevents a new password from matching any of those recent ones. The number kept is configurable (for example, the system might remember the last 5 or last 24 passwords), and any attempt to reuse one of them is rejected. This forces users to create truly new credentials rather than cycling back to an old password, reducing the risk of password reuse across changes.

Audit logging records events like password changes but doesn’t enforce reuse restrictions. Minimum age controls how soon a password change can occur, not which passwords are allowed. Multifactor authentication adds an extra login factor, but it doesn’t address reusing prior passwords.