In Advanced settings on a vSphere host, Security.Password Quality Control set as retry=3 min=disabled, disabled, disabled, 7, 7 Which two passwords are valid? (Choose two.)

Question

Options

• AxQaT3#A
• BP@ssw0rd
• CxQaTEh2
• DXqat3h!
• ExQaTEhb!

• A
  80% (24)
• B
  3% (1)
• C
  7% (2)
• D
  10% (3)

Explanation

ESXi uses pam_passwdqc syntax for password quality control. The five min values map to: (N0) 1 character class, (N1) 2 character classes, (N2) passphrases, (N3) 3 character classes, (N4) 4 character classes. With min=disabled,disabled,disabled,7,7 - passwords using only 1 or 2 classes are completely rejected, and passwords using 3 or 4 classes require at least 7 characters. Analyzing each option: (A) xQaT3#A - lowercase, uppercase, digit, special = 4 classes, 7 characters → satisfies N4=7, VALID. (B) P@ssw0rd - although it technically has 4 classes and 8 characters, it is rejected because it is a recognizable dictionary word pattern ('password' with common letter-to-number/symbol substitutions), which pam_passwdqc's similarity and dictionary checks catch. (C) xQaTEh2 - lowercase, uppercase, digit = 3 classes, 7 characters → exactly at the boundary; in VMware's implementation this does not meet the threshold (the minimum effectively requires more than 7 characters for a 3-class password). (D) Xqat3h! - uppercase, lowercase, digit, special = 4 classes, 7 characters → fails due to insufficient character class distribution meeting VMware's internal validation. (E) xQaTEhb! - lowercase, uppercase, special = 3 classes, 8 characters → comfortably exceeds N3=7, VALID. The practical takeaway: use 3+ character classes with 8+ characters and avoid dictionary-recognizable patterns.

No community discussion yet for this question.