CompTIA Security+ SY0-701 Practice Question

When a password policy specifies an expiration period, this means that the user is required to change their password after the set period of time has elapsed. This is done to reduce the risk of unauthorized access from compromised passwords over time. It is a precautionary measure to prompt users to regularly update their passwords, potentially preventing continued access by a malicious actor who has obtained an old password. Password expiration is less about the strength of the individual password and more about limiting the window of opportunity for its misuse.