easyMultiple Select
200-201 Practice Question: A security policy requires that employees use…
A security policy requires that employees use strong passwords. Which TWO of the following are characteristics of a strong password? (Select two.)
⚠ Common exam trap
Cisco often tests the distinction between password policy requirements (like expiration intervals) and intrinsic password strength characteristics, leading candidates to mistakenly select 'changed every 90 days' as a strength attribute.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Uses a mix of uppercase, lowercase, numbers, and special characters
Option A is correct because a strong password uses complexity — a mix of uppercase letters, lowercase letters, digits, and special characters — which increases the search space and makes brute-force and dictionary attacks far less likely to succeed. Option E is correct because length is a primary strength factor; a minimum of at least 8 characters provides enough entropy to resist rapid guessing, and longer passwords are even stronger. Option B does not belong because a 90-day rotation schedule is a password-expiration/aging policy, not an inherent characteristic of the password's strength itself, and frequent forced changes can even lead to weaker, predictable patterns. Option C is wrong because a common dictionary word is trivially defeated by dictionary and hybrid attacks. Option D is wrong because including the username makes the password guessable and violates the principle of not deriving credentials from publicly known identifiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Uses a mix of uppercase, lowercase, numbers, and special characters
Why this is correct
Complexity across character classes directly satisfies the policy's strength requirement: combining uppercase, lowercase, digits and symbols expands the search space an attacker must exhaust, defeating brute-force and dictionary attacks. Length alone is insufficient if the password remains a single-case dictionary word, so this mixed composition is a defining characteristic of strong passwords.
- ✗
Is changed every 90 days
Why it's wrong here
Password aging is a policy requirement, not a characteristic of strength.
- ✗
Is a common dictionary word
Why it's wrong here
Dictionary words are trivially defeated by wordlist and brute-force attacks, so they cannot satisfy a strong-password policy. It tempts because such words are memorable and easy to type, and would be acceptable only where length and complexity requirements are deliberately relaxed.
- ✗
Contains the user's username
Why it's wrong here
Embedding the username makes the password guessable from publicly known account details, defeating the policy's strength requirement. It tempts because it aids memorability, and would be fine only where credentials are never exposed and no strong-password policy applies.
- ✓
At least 8 characters
Why this is correct
Eight characters is the minimum length Microsoft's guidance treats as acceptable for a strong password, satisfying the policy's complexity requirement alongside character variety. Length alone is insufficient, but it remains a baseline characteristic, since shorter passwords fall to brute-force and dictionary attacks far more quickly.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.