Which policy focuses on managing how credentials and passwords are created and used across an organization?

• A. Password Policies
• B. Complexity
• C. Credential Management
• D. Privileged Access Management

Answer: (C)

The concept being tested is how organizations govern the creation and use of credentials and passwords, which is credential management. This policy covers the entire lifecycle of credentials—how they are issued, stored securely, rotated or revoked, and retired when no longer needed. It also includes enforcing authentication methods (like MFA), managing different types of credentials (passwords, keys, certificates), and ensuring consistent practices across systems and services.

Password policies focus on specific rules for passwords themselves, such as length and complexity, and do not alone address the broader lifecycle and governance of all credentials. Privileged Access Management targets protections and controls for highly sensitive admin accounts, offering additional safeguards beyond everyday user credentials. Credential management, by contrast, encompasses these aspects and governs how credentials are created, managed, and used throughout the organization.