Quick Answer

The answer is security passwords min-length, which matches the infrastructure hardening technique of setting a minimum password length. This command is correct because it directly enforces a policy that all local device passwords must meet a specified character count, reducing vulnerability to brute-force attacks. On the ENCOR 350-401 exam, drag-and-drop items like this test your ability to recall exact Cisco IOS commands for common security controls, often pairing a technique with its CLI counterpart. A common trap is confusing security passwords min-length with service password-encryption, which only encrypts stored passwords rather than enforcing length. To remember this, think of the command as a direct policy enforcer: security sets the rule, passwords targets the credential, and min-length specifies the constraint. For the other pairings, recall that disabling unused ports uses shutdown, setting a login banner uses banner login, enabling SSH uses ip ssh version 2, and restricting VTY access uses access-class. A useful mnemonic for the full set is “Shut Banners, SSH, Access, and Length” to keep the sequence straight during the exam.