Some websites won’t allow you to reuse an old password when changing your current one. If the administrator does not store your past passwords, how does it know if one of your new passwords matches an old password? Explain your answer in detail.

What will be an ideal response?

Storing a password in plain text is a security vulnerability since a hacker could obtain many user passwords if he successfully compromised the database. Instead, administrators encrypt passwords and store the encrypted copies. Then they check the encrypted copy of the password you attempt to set against the stored old copies, and reject your attempt if a match is found.