Default accounts and passwords are predefined and usually associated with default accounts. Which statement is true?

• A. They are randomly generated on first login
• B. They are predefined and usually associated with default accounts
• C. They are changed daily at login
• D. They require multi-factor authentication

Answer: (B)

Default accounts and passwords are built into devices and software by vendors. They are predefined, meaning they exist before you start using the product, and they’re usually tied to the default accounts that ship with the system. Because those credentials are often publicly documented, leaving them unchanged creates an easy entry point for attackers. So this statement is true: these credentials come predefined and are associated with the default accounts that ship with the product. To reduce risk, organizations must change vendor-supplied defaults and disable or restrict default accounts before putting systems into production. The other ideas don’t fit how default credentials work: they’re not typically randomly generated on first login, daily changes aren’t standard, and while multi-factor authentication is good practice, it doesn’t define default credentials themselves.