Password Audit Remediation: Length and Complexity in Authentication Policy

SY0-701 By islever Editorial Last updated

Given a scenario, implement and maintain identity and access management.

Short answer

AB Include minimum password length and character complexity requirements in the authentication policy because the password audit targets weak password construction, not authorization or biometric factors.

Question

A security analyst needs to improve the company’s authentication policy following a password audit. Which of the following should be included in the policy? (Choose two.)
  1. Length Correct Answer
  2. Complexity Correct Answer
  3. Least privilege
  4. Something you have
  5. Security keys
  6. Biometrics

Key Takeaways

It tests the distinction between password-policy parameters (length and complexity) and broader authentication factors or access-control principles, with the trap being to select security keys or biometrics simply because they are stronger authenticators.

This SY0-701 question tests how a password audit should translate into authentication-policy requirements. The correct choices are A and B: minimum password length and complexity requirements.

Common mistake: The most tempting error is choosing E (security keys) or F (biometrics) because they sound like stronger authentication; however, they are authentication methods or factors, not password-policy settings that remediate findings from a password audit.

Expert Analysis

The controlling qualifier is the audit, not authentication in general. The stem says the analyst is improving the authentication policy after a password audit. That ties the required policy content to password construction: the organization has evidence that passwords are weak, so the remediation is to define stronger password requirements. The phrase "Choose two" then forces a narrow selection; it does not ask for a complete authentication architecture.

A and B directly answer the audit finding. Option A (Length) sets a minimum password or passphrase size, increasing the work an offline cracker or guessing attack must do. Option B (Complexity) requires character variety or other composition rules, which is a traditional password-policy control. Community explanations repeatedly describe these two as fundamental password-policy components and note that a password audit leads to password rules. Thus A and B are the intended pair.

C is a different control family. Least privilege limits what an authenticated user can access or do; it is authorization and access control, not a rule about how the password is formed. It might be good policy elsewhere, but it does not remediate a weak-password finding.

D, E and F are authentication methods or factors, not password settings. "Something you have" is a factor category; security keys are a hardware possession authenticator; biometrics are inherence factors. They could strengthen authentication through MFA, but the question asks what to include after a password audit in the authentication policy, and selecting them because they sound "stronger" ignores the stem's password-policy context. They are distractors, not the two requested settings.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an exam question says a password audit prompted the policy change, separate password-construction controls from authentication factors. Scan options for the two settings that directly constrain how passwords are created—length and complexity—and treat hardware keys or biometrics as possible MFA enhancements unless the stem asks how to strengthen authentication beyond passwords. Also eliminate authorization concepts such as least privilege early; they belong to access control, not password policy.

Frequently Asked Questions

Why aren't security keys or biometrics the best answer after a password audit?

They are stronger authenticators, but the question asks for password-policy content following an audit. A and B directly remediate weak password construction, while E and F describe authentication methods or factors.

Is least privilege part of an authentication policy?

No. Least privilege is an authorization and access-control principle limiting what an authenticated account can do; it does not define password length or complexity.

Does modern NIST guidance still recommend complexity rules?

NIST emphasizes length, blocklists, and avoiding composition rules, but SY0-701 password-policy questions commonly pair minimum length with complexity as standard policy settings. Answer the exam doctrine unless the stem explicitly cites modern guidance.

More SY0-701 FAQ →

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. kalmax5400 👍 6 Answered A
    A.B: Length + Complexity
  2. 5a11b63 👍 3 Answered A
    A. Length ✅ Yes. Longer passwords/passphrases are one of the most effective improvements. B. Complexity ✅ Yes. Traditionally used (upper/lowercase, numbers, symbols), though modern guidance favors length over strict complexity rules. Still, it’s a common policy element.
  3. DaBulls 👍 3 Answered B
    AB - Complexity + Lenght
  4. Anyio 👍 2 Answered A
    The correct answers are: A. Length B. Complexity Explanation: Length (A) and Complexity (B) are fundamental components of a strong password policy. Increasing password length and requiring a mix of characters (uppercase, lowercase, numbers, and special symbols) significantly enhances security by making passwords harder to crack. Least privilege (C) is an access control principle, not directly related to password policies. Something you have (D), Security keys (E), and Biometrics (F) are related to multi-factor authentication (MFA), which is a separate security measure and not part of the password policy itself. Thus, Length and Complexity are the most relevant elements to include in an improved authentication policy following a password audit.
  5. fc040c7 👍 2 Answered A
    Ah I see why people are only showing one answer. It doesn’t let you choose two…answers are A and B if we are talking about password policy
Show 8 more comments
  1. Bawaa 👍 2 Answered A
    AB is the correct answer
  2. dbrowndiver 👍 1 Answered A
    A. Length: Description: A longer password is generally more secure, as it increases the number of possible combinations that an attacker would need to guess or brute-force. Policy Implementation: Requiring a minimum length for passwords (e.g., 12 or more characters) significantly improves security. B. Complexity: Description: Complexity ensures that passwords include a mix of uppercase letters, lowercase letters, numbers, and special characters. This makes passwords less predictable and harder to crack. Policy Implementation: Requiring complexity prevents users from choosing weak or easily guessable passwords like "password123."
  3. trac0420 👍 1
    • Why A and B are correct: The prompt specifies that the policy update is being done "following a password audit." In organizational security, password audits evaluate the strength of employee passwords against automated cracking or guessing techniques. To directly remediate weak or compromised passwords found during an audit, a security analyst modifies the policy requirements for minimum password length and character complexity (e.g., uppercase, lowercase, numbers, and special characters).
  4. lmartinez300 👍 1
    AB is correct since we're focusing on how to make a password better.
  5. tailogdavid1987 👍 1
    A password audit leads to password rules: length and complexit
  6. ramzie 👍 1 Answered B
    The answer is A : length and B : complexity
  7. TechNewb1 👍 1 Answered A
    The other answer is..?
  8. Justyna1685 👍 1 Answered B
    AB is the correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide