For first-time use and password resets, what must be done with the credentials?

For first-time use and password resets, what must be done with the credentials?

• A. Set To A Unique Value For Each User And Change After First Use
• B. Use A Common Temporary Password For All Users
• C. Do Not Require Password Changes After First Use
• D. Keep The Password Unchanged After Reset

Answer: (A)

Handling credentials for first-time use or after a reset is about secure provisioning. The best practice is to give each user a unique temporary value and force a password change on first login. This prevents a single shared value from granting access to many accounts, and it ensures the user creates a password that only they know. Forcing the change right after first use closes the window where someone could exploit a known temporary credential and aligns with strong authentication controls. Using a common temporary password for all users or not requiring a change after first use leaves accounts vulnerable to compromise, and keeping the password unchanged after a reset repeats the same risk.

Handling credentials for first-time use or after a reset is about secure provisioning. The best practice is to give each user a unique temporary value and force a password change on first login. This prevents a single shared value from granting access to many accounts, and it ensures the user creates a password that only they know. Forcing the change right after first use closes the window where someone could exploit a known temporary credential and aligns with strong authentication controls.

Using a common temporary password for all users or not requiring a change after first use leaves accounts vulnerable to compromise, and keeping the password unchanged after a reset repeats the same risk.