With the meeting password and waiting room turned on, the vast majority of zoom bombing attempts will be prevented. However, if a student shares the meeting URL, ID and password, and provides the name of someone you'd expect to join your meeting, it is still possible that you could unwittingly admit someone from the waiting room that shouldn't be.