The systems administrator notices that many employees are using passwords that can be easily guessed or are susceptible to brute force attacks. Which of the following would BEST mitigate this risk?

Password complexity policies mandate that passwords include multiple character classes, which dramatically expands the keyspace an attacker must search during a brute force attack and simultaneously prevents easily guessable patterns like dictionary words or simple names. This directly addresses both attack vectors mentioned in the question - guessability and brute force susceptibility. Complexity rules are the most comprehensive single control because they constrain password composition rather than only one dimension of password strength.

Shortening the maximum password life means compromised passwords are valid for less time but does nothing to prevent weak or guessable passwords from being set in the first place.

Increasing minimum length improves brute force resistance but does not prevent users from choosing long but still easily guessable strings such as a repeated word.

Account lockout policies limit the number of brute force attempts but do not address the root problem of users choosing weak or guessable passwords.