A security administrator is reviewing the below output from a password auditing tool: P@ss. @pW1. S3cU4 Which of the following additional policies should be implemented based on the tool's output?

The correct answer is C. Password length. The passwords shown (P@ss, @pW1, S3cU4) are all 4–5 characters long but already demonstrate complexity - they include uppercase letters, lowercase letters, numbers, and special characters. The existing complexity policy is already working. The critical gap exposed by the tool…

Security operations

Question

A security administrator is reviewing the below output from a password auditing tool:

P@ss. @pW1. S3cU4 Which of the following additional policies should be implemented based on the tool's output?

Options

APassword age
BPassword history
CPassword length
DPassword complexity

How the community answered

(29 responses)

A
10% (3)
B
3% (1)
C
83% (24)
D
3% (1)

Explanation

The passwords shown (P@ss, @pW1, S3cU4) are all 4–5 characters long but already demonstrate complexity - they include uppercase letters, lowercase letters, numbers, and special characters. The existing complexity policy is already working. The critical gap exposed by the tool output is that these passwords are far too short, making them susceptible to brute-force attacks. A minimum password length policy (e.g., requiring at least 8–12 characters) would directly address this weakness. Password age, history, and complexity policies are not the issue since the sample passwords already exhibit diverse character types.

Topics

#password policy#password length#authentication#policy analysis

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice