What elements should be included in a strong password policy?

• A. Minimum length, complexity, expiration, no reuse, and account lockout policies.
• B. Requiring only uppercase letters.
• C. No expiration to minimize user friction.
• D. Using the same password for all accounts.

Answer: (A)

A strong password policy focuses on making passwords harder to guess and easier to manage securely. Requiring a minimum length increases the number of possible combinations an attacker must try, raising the time and effort needed to crack the password. Adding complexity by including a mix of uppercase and lowercase letters, numbers, and symbols further expands the search space and reduces the chance of simple, common patterns. Setting expiration prompts users to update credentials regularly, limiting the window of opportunity for a password that may have been compromised to be used. Prohibiting password reuse ensures that a password exposed in one breach cannot be used to access multiple accounts. Implementing an account lockout or similar throttling mechanism after failed login attempts helps defend against automated brute-force attacks by slowing or stopping repeated guesses.

Requiring only uppercase letters provides insufficient complexity and entropy. Keeping passwords valid indefinitely increases risk if a password is ever compromised. Reusing the same password across multiple accounts creates a single point of failure if any one service is breached.