Which statement describes a secure password standard?

Which statement describes a secure password standard?

• A. 16 characters with all numbers only
• B. 8 characters with only lowercase letters
• C. Any password is acceptable with no rotation
• D. 12+ characters with mix of upper/lower/digits/special, no reuse, rotation every 90 days

Answer: (D)

The test is about what makes a password standard secure: longer length combined with varied character types, plus precautions to prevent reuse and limit how long a stolen credential remains usable. The best description is the one that sets 12 or more characters, includes a mix of upper and lower case letters, digits, and special characters, forbids reusing passwords across accounts, and requires rotation every 90 days. This combination dramatically expands the number of possible passwords (entropy) and makes it far harder for attackers to guess or reuse credentials. Prohibiting reuse stops a breach from propagating across sites, and periodic rotation reduces the window of opportunity if a password is compromised. The other options fall short because a long password that uses only numbers lacks the complexity that mixes different character types, making it easier to crack than a truly diverse set. A password with only lowercase letters is both short and lacks diversity, reducing entropy significantly. Allowing any password with no rotation misses ongoing protection; without rotation, a leaked password can be exploited for a long time.

The test is about what makes a password standard secure: longer length combined with varied character types, plus precautions to prevent reuse and limit how long a stolen credential remains usable. The best description is the one that sets 12 or more characters, includes a mix of upper and lower case letters, digits, and special characters, forbids reusing passwords across accounts, and requires rotation every 90 days. This combination dramatically expands the number of possible passwords (entropy) and makes it far harder for attackers to guess or reuse credentials. Prohibiting reuse stops a breach from propagating across sites, and periodic rotation reduces the window of opportunity if a password is compromised.

The other options fall short because a long password that uses only numbers lacks the complexity that mixes different character types, making it easier to crack than a truly diverse set. A password with only lowercase letters is both short and lacks diversity, reducing entropy significantly. Allowing any password with no rotation misses ongoing protection; without rotation, a leaked password can be exploited for a long time.