More than 90 days have elapsed since a user created an account for a banking website. The next time the user attempts to log in, they receive a prompt to create a new password. Which of the following

Password length policies require a minimum number of characters for a new password, which is not indicated by a timed password change.

Password history policies prevent users from reusing previous passwords, which is distinct from being forced to change a password after a set time.

Password complexity policies dictate the types of characters (e.g., uppercase, numbers, symbols) that must be included in a password, not the frequency of changes.

Password expiration is a security policy that forces users to change their passwords after a specific duration, typically to reduce the risk of compromised passwords remaining valid indefinitely. The prompt to create a new password after 90 days directly indicates this policy is in effect.