To enhance password security, which policy should be prioritized?

• A. Implement a policy requiring passwords to be at least 16 characters long with no complexity requirements
• B. Enforce 6-character passwords with no complexity
• C. Implement a policy requiring passwords to be at least 12 characters long and include a mix of uppercase, lowercase, numbers, and special characters
• D. Allow passcodes instead of passwords for all users

Answer: (C)

Strengthening passwords relies on both enough length and enough diversity in the characters used. A policy that requires at least 12 characters and a mix of uppercase, lowercase, numbers, and special characters increases the search space and raises entropy per character, making brute-force and dictionary attacks far more difficult. Longer passwords help, but without variety they can still be guessed if users rely on common patterns or words; combining length with multiple character classes creates robust, harder-to-predict credentials. A policy of 16 characters with no complexity could allow weak patterns to slip through, while a very short, no-complexity rule is trivially cracked. Replacing passwords with passcodes generally reduces security because it often lowers the overall unpredictability and increases guessability.