A company's current password policy requires a minimum of 14 characters with complexity (uppercase, lowercase, numbers, and special characters). Users frequently forget these complex passwords and submit help desk reset requests. Which alternative approach would BEST enhance security while reducing the burden on users?

Reduce the minimum password length to 8 characters to make passwords easier to type

Reducing length significantly decreases resistance to brute-force cracking, making it a security downgrade despite easing user memory.

Enforce password expiration every 30 days

Frequent password changes often lead users to create weak, incremental passwords (e.g., 'May2024!, Jun2024!') and increase reset calls, without proportional security benefit.

Implement single sign-on with smart cards and PINs

Smart card authentication is strong but requires purchasing readers, distribution, and management; it may reduce password burden but does not directly address the password complexity issue and adds cost.

What does this 220-1102 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Allow users to use passphrases instead of complex passwords — Passphrases consist of a sequence of random words or a sentence. They are much longer (thus resistant to brute-force attacks) yet easier for users to remember than a jumble of characters. Complexity requirements often lead to predictable patterns (e.g., 'Password1!'), which can be weaker than a long passphrase. Reducing password length or enforcing frequent expiration can actually weaken security or add user friction. Smart cards require additional hardware and infrastructure.

What should I do if I get this 220-1102 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.