How often are authentication codes changed?

How often are authentication codes changed?

• A. Every month
• B. Only when a password reset is requested
• C. Every 2 years
• D. Every 6 months or when compromised

Answer: (D)

Regular changes of authentication codes limit the window of opportunity if a code is exposed. The best option sets a practical cadence—every six months—and also allows immediate rotation if there’s any sign of compromise. This balances security with usability: codes aren’t left valid for too long, but the process isn’t so burdensome that it’s ignored. If a breach is suspected, rotating right away stops attackers from using any potentially leaked codes. Other timings are less effective. Changing codes monthly adds unnecessary friction without a proportional risk reduction, waiting until a password reset happens misses other moments when a code could be exposed, and a two-year interval leaves too long a span for an attacker to exploit a compromised code.

Regular changes of authentication codes limit the window of opportunity if a code is exposed. The best option sets a practical cadence—every six months—and also allows immediate rotation if there’s any sign of compromise. This balances security with usability: codes aren’t left valid for too long, but the process isn’t so burdensome that it’s ignored. If a breach is suspected, rotating right away stops attackers from using any potentially leaked codes.

Other timings are less effective. Changing codes monthly adds unnecessary friction without a proportional risk reduction, waiting until a password reset happens misses other moments when a code could be exposed, and a two-year interval leaves too long a span for an attacker to exploit a compromised code.