How Should Password Policy Be Strengthened After an Account Compromise?

Easy-to-guess passwords led to an account compromise. The current password policy requires at least 12 alphanumeric characters, one uppercase character, one lowercase character, a password history of two passwords, a minimum password age of one day, and a maximum password age of 90 days. Which of the following would reduce the risk of this incident from happening again? (Choose two.)

Increasing the minimum password length to 14 characters. Source Reference Answer
Upgrading the password hashing algorithm from MD5 to SHA-512.
Increasing the maximum password age to 120 days.
Reducing the minimum password length to ten characters.
Reducing the minimum password age to zero days.

Community Insight

The test checks whether you can identify which controls actually reduce password-guessing risk: longer length increases entropy, and a stronger hash (SHA-512) makes offline cracking harder. The trap is assuming any option about password age or history helps, when those do not address the root cause of guessable passwords.

For a CompTIA SY0-701 question about easy-to-guess passwords, the correct risk-reducing choices are increasing password length and upgrading the password hashing algorithm. The community often expects adding special characters, but among the listed options, length and hashing are the two that directly improve resistance to guessing and cracking.

Thinking that increasing the maximum password age (C) or reducing the minimum password age (E) reduces risk; these changes either keep weak passwords in use longer or allow users to cycle back to old passwords, both of which increase risk.

Community Discussion (6 comments)

b82faaf 👍 8 Selected: A

Since the issue is with the passwords being easy to guess, the solution would be one that addresses password complexity (and not password history or age necessarily). Increasing the minimum length of the password and introducing a special character would be the best options for this.

Anyio 👍 2 Selected: A

The correct answers are: A. Increasing the minimum password length to 14 characters F. Including a requirement for at least one special character Explanation: A. Increasing the minimum password length to 14 characters: Longer passwords are harder to guess or brute-force, making them more secure. F. Including a requirement for at least one special character: Adding special characters increases password complexity, reducing the likelihood of successful guessing or brute-force attacks. Other Options: B. Upgrading the password hashing algorithm from MD5 to SHA-512: This improves how passwords are stored but doesn’t directly prevent weak passwords from being used.

AndyK2 👍 1 Selected: A

A. Increasing the minimum password length to 14 characters F. Including a requirement for at least one special character Rationale: Increasing password length: Exponentially increases password complexity Makes brute-force attacks more difficult Longer passwords are harder to guess Adding special character requirement: Increases password entropy Adds complexity to password creation Reduces predictability of password patterns Why other options are less effective: Upgrading hash algorithm (B) improves storage security but doesn't directly prevent weak passwords Increasing maximum password age (C) doesn't improve password strength Reducing password length (D) weakens password security Reducing minimum password age (E) allows more frequent password changes, which can lead to weaker passwords The goal is to create passwords that are both complex and memorable, making them resistant to both guessing and brute-force attacks.

viktorrdlyi 👍 1 Selected: B

As mentioned below

viktorrdlyi 👍 1 Selected: B

MD-5 have a collision chance!

jafyyy 👍 1

AF These options add further complexity.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A is correct because increasing the minimum password length from 12 to 14 characters makes passwords exponentially harder to guess or brute-force, directly addressing the stated cause of easy-to-guess passwords. B is also correct because upgrading the hash algorithm from MD5 to SHA-512 makes offline password cracking far more difficult, reducing the risk of a compromised hash database being decoded. Together these two options are the only ones that improve security posture among the available choices.

Why the Other Options Are Wrong

C (increasing maximum password age to 120 days) weakens security by letting users keep a potentially guessable password for a longer period. D (reducing minimum length to 10) directly reduces password entropy. E (reducing minimum age to 0) lets users immediately change passwords, which can bypass password history and reuse old passwords. None of these reduce risk; they increase it.

Community Comment Notes

Comments [1], [2], and [3] correctly identify that increasing password length is the primary fix, but they also mention adding a special-character requirement (F). Option F is not present in the supplied list, so the only valid second answer from the available choices is B. Comments [5] and [6] correctly point out MD5 is weak, supporting B. Note the question asks for two answers, so A and B are the right pair here.

Official Reference

Exam Strategy

When a question says 'easy-to-guess passwords led to compromise,' focus on making passwords harder to guess or harder to crack. Eliminate any options that shorten password life or reduce complexity, and be ready to accept a stronger hashing algorithm as a valid defensive measure when a 'special characters' option is missing.

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide