A systems administrator wants to ensure users cannot change their passwords to ones they have used before. Which of the following password best practices should the administrator implement?

Password complexity requirements enforce rules like using a mix of characters, but they do not prevent the reuse of past passwords.

Password length requirements dictate the minimum or maximum number of characters but do not prevent the reuse of old passwords.

Password expiration forces users to change their passwords after a certain period but does not inherently prevent them from reusing a previous password without an accompanying history policy.

A password history policy remembers a specified number of a user's old passwords and prevents them from being reused when setting a new password. This crucial security measure helps mitigate the risk of attackers guessing old, compromised passwords.