Several employee accounts appear to have been cracked by an attacker. Which of the following should the security administrator implement to mitigate password cracking attacks? (Select TWO).

Password complexity requirements (uppercase, lowercase, numbers, symbols) dramatically increase the number of possible combinations an attacker must try, making brute-force and dictionary attacks computationally impractical.

An IDS can detect suspicious login attempts but does not prevent the cracking of passwords that have already been captured or hashed.

Password history prevents reuse of old passwords but does not make current passwords harder to crack.

Monitoring logins can detect attacks after the fact but does not mitigate the underlying vulnerability of weak passwords.

Password expiration limits the window of exploitation of a cracked password but does not make the password itself harder to crack.

Increasing password length has an exponential effect on the total keyspace - each additional character multiplies the number of possible passwords, making cracking attacks far more time-consuming and resource-intensive.