Explanation
The best explanation for password expiration is to invalidate any compromised passwords. Password expiration is a security policy that requires users to change their passwords after a certain period of time, such as every 90 days. This reduces the risk of unauthorized access if an attacker obtains the user's password through phishing, hacking, or other means. If the user changes their password regularly, the old password becomes useless for the attacker. Password expiration does not necessarily disable unused user IDs, as the user may still be able to log in with their new password. Password expiration does not discourage writing down passwords, as some users may still do so to remember their new passwords. Password expiration does not enforce new password complexity rules, as those rules apply to any password change regardless of expiration. References: CompTIA IT Fundamentals (ITF+) Study Guide: Exam FC0-U61, Second Edition, Chapter 5: Database Fundamentals and Security Concepts, page 181