A recent audit has discovered that at the time of password expiration clients are able to recycle the
previous credentials for authentication. Which of the following controls should be used together to
prevent this from occurring? (Select TWO).

A.
Password age

B.
Password hashing

C.
Password complexity

D.
Password history

E.
Password length

Explanation:
D: Password history determines the number of previous passwords that cannot be used when a
user changes his password. For example, a password history value of 5 would disallow a user
from changing his password to any of his previous 5 passwords.
A: When a user is forced to change his password due to a maximum password age period
expiring, he could change his password to a previously used password. Or if a password history
value of 5 is configured, the user could change his password six times to cycle back round to his
original password. This is where the minimum password age comes in. This is the period that a
password must be used for. For example, a minimum password age of 30 would determine that
when a user changes his password, he must continue to use the same password for at least 30
days.