An engineer is configuring a guest password policy and needs to ensure that the password complexity requirements are set to mitigate brute force attacks. Which two requirement complete this policy?…

A minimum password length increases the number of possible combinations, making brute-force attacks computationally more expensive and time-consuming for attackers.

An active username limit typically refers to concurrent user sessions or account management, not directly to password complexity or brute-force mitigation on the password itself.

Access code control is a specific mechanism for guest access management (e.g., using a single code for multiple guests), not a general password policy requirement to mitigate brute force.

A password expiration period forces users to change their passwords regularly, which limits the window of opportunity for attackers to successfully use a compromised or brute-forced password.

A username expiration date relates to the longevity of a guest account, not the strength or lifecycle of the password itself in defense against brute force attacks.