What are the strengths and weaknesses of self-service password reset, and how should it be secured?

• A. Strength: Reduces Help Desk Load; Weakness: Potential Abuse If Identity Verification Is Weak
• B. Strength: Increases Security; Weakness: Expensive To Implement
• C. Strength: Requires No Verification; Weakness: Not Scalable
• D. Strength: Reduces Help Desk Load And Speeds Onboarding; Weakness: Potential Abuse If Identity Verification Is Weak

Answer: (D)

Self-service password reset (SSPR) lets users prove who they are and reset their password without calling the help desk, so access issues are resolved quickly and onboarding experiences are smoother. The strongest description recognizes both the tangible operational benefit and the security caveat: it reduces the help desk workload and speeds onboarding, but its weakness is potential abuse if identity verification is weak. When verification is robust—using MFA, out-of-band checks, device-based trust, and risk-based prompts—SSPR provides both convenience and security. If verification is weak, attackers can exploit the flow to gain access, which is why strong identity checks are essential.

Other options miss key realities: claiming it increases security ignores that security depends on verification strength; saying no verification is required is incorrect because that would be insecure; and suggesting it isn’t scalable ignores the efficiency gains from fewer help-desk interactions.