What is a secure process for handling password resets in an enterprise?

Prepare for your Helpdesk Technician Interview with our interactive test. Practice with flashcards and multiple-choice questions. Get ready to succeed!

Multiple Choice

What is a secure process for handling password resets in an enterprise?

Explanation:
Verifying identity before a password reset is essential to prevent account compromise. Using multi-factor authentication or out-of-band checks ties the reset to something the user physically possesses or a separate trusted channel, such as an authenticator app code, a hardware token, a push notification, or a verified phone/SMS or phone call. This makes it far harder for someone who only knows a username or previously used password to hijack the account, because they’d need that second factor or an alternate trusted channel. Emailing a reset password is insecure because email can be intercepted or accessed by someone other than the legitimate user, especially if the user’s email account is compromised. Requiring a supervisor to authorize a reset introduces friction and doesn’t guarantee the requester’s identity; it also doesn’t scale well and can be exploited or bypassed. Disabling auditing removes crucial visibility and accountability, making it easier for bad actors to operate without detection. So the secure approach is to verify identity with MFA or out-of-band checks, ensuring the person requesting the reset proves access to a trusted factor or channel before the password is reset.

Verifying identity before a password reset is essential to prevent account compromise. Using multi-factor authentication or out-of-band checks ties the reset to something the user physically possesses or a separate trusted channel, such as an authenticator app code, a hardware token, a push notification, or a verified phone/SMS or phone call. This makes it far harder for someone who only knows a username or previously used password to hijack the account, because they’d need that second factor or an alternate trusted channel.

Emailing a reset password is insecure because email can be intercepted or accessed by someone other than the legitimate user, especially if the user’s email account is compromised. Requiring a supervisor to authorize a reset introduces friction and doesn’t guarantee the requester’s identity; it also doesn’t scale well and can be exploited or bypassed. Disabling auditing removes crucial visibility and accountability, making it easier for bad actors to operate without detection.

So the secure approach is to verify identity with MFA or out-of-band checks, ensuring the person requesting the reset proves access to a trusted factor or channel before the password is reset.

More practice questions