💡 In this scenario, the default password ("123456") is assigned to new users, and they are required to change it upon their first login. The concern the internal auditor and the database administrator are likely discussing is the security risk in the period before the user changes their password. During this window: The default password is predictable and could be exploited by an attacker. If an unauthorized person gains access to the default password, they could compromise the account before the legitimate user logs in and changes it.