nerdexam
GIAC

GPEN · Question #8

Which of the following options holds the strongest password?

The correct answer is B. $#164aviD^%. Password strength is determined by length combined with character-set diversity - mixing uppercase, lowercase, digits, and special characters without dictionary words maximizes entropy and resistance to attacks.

Penetration Testing Foundations & Reconnaissance

Question

Which of the following options holds the strongest password?

Options

  • Acalifornia
  • B$#164aviD^%
  • CAdmin1234
  • DJoe12is23good

How the community answered

(57 responses)
  • A
    14% (8)
  • B
    75% (43)
  • C
    4% (2)
  • D
    7% (4)

Why each option

Password strength is determined by length combined with character-set diversity - mixing uppercase, lowercase, digits, and special characters without dictionary words maximizes entropy and resistance to attacks.

Acalifornia

'california' is a single, all-lowercase dictionary word with no numbers or special characters, making it trivially vulnerable to a basic dictionary or wordlist attack.

B$#164aviD^%Correct

$#164aviD^% is the strongest password because it combines special characters ($, #, ^, %), both uppercase and lowercase letters, and numeric digits, with no recognizable dictionary words or predictable sequences. This diversity across multiple character classes maximizes entropy and makes the password resistant to both dictionary attacks and brute-force enumeration, aligning with NIST complexity recommendations.

CAdmin1234

'Admin1234' combines a widely used privileged account name with a simple sequential number pattern - both components appear at the top of virtually every password attack wordlist and rule set.

DJoe12is23good

'Joe12is23good' contains only common words and digits with no special characters, making it susceptible to hybrid dictionary attacks that append or interleave numbers with dictionary terms despite its length.

Concept tested: Password complexity and entropy for strong credentials

Source: https://pages.nist.gov/800-63-4/sp800-63b.html

Topics

#password strength#complexity requirements#authentication

Community Discussion

No community discussion yet for this question.

Full GPEN Practice