A company's security audit reveals that several employees are using weak passwords that can be easily guessed. The current password policy requires a minimum of 8 characters but does not enforce complexity. Which change to the password policy would be MOST effective in increasing security against brute-force attacks?

Require a mix of uppercase, lowercase, numbers, and special characters

Complexity increases entropy but not as much as increasing length; length is more effective against brute-force.

Implement account lockout after 3 failed attempts

Account lockout prevents online brute-force but does not protect against offline attacks on password hashes.

Force password change every 30 days

Frequent changes often lead to weaker, easily guessable passwords or reuse, reducing security.

What does this 220-1101 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Increase minimum password length to 12 characters — Increasing password length exponentially increases the number of possible combinations, making brute-force attacks significantly harder. While complexity helps, length has a greater impact. Account lockout prevents online brute-force but not offline attacks. Frequent password changes often lead to weaker passwords or predictable patterns.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.