Exam SY0-601 topic 1 question 150 discussion

Answer: Password complexity Password complexity is a measure of how difficult a password is to guess in relation to any number of guessing or cracking methods. For the security auditor to be able to successfully perform a dictionary attack, that means that the credentials were too predictable and was likely a common password.

It's true that a password length is more important than complexity, but in my guide from Darill Gibson there is no such thing as password length. It is mentioned but the complexity is the control that was violated

A. Password Complexity

There is a strong argument for C but I’m sure that’s not it since 90% chose A. A dictionary attack can be a library of compromised passwords from other sites which users could use the same passwords across multiple accounts which would be a violation. But then again, restricting password reuse across multiple accounts from different platforms is likely not enforceable in most scenarios.

The security policy states that common words should not be used as passwords, which implies that the passwords should have certain complexity requirements to avoid using easily guessable passwords. A dictionary attack is an attempt to crack passwords by systematically trying words from a dictionary, and it can be successful when passwords lack complexity. By enforcing password complexity requirements, organizations aim to prevent attackers from using simple and common words as passwords.

we need more easy questions like this

A makes the most amount of sense to me.

passwords in common dictionary is not necessarily not complex. In the well-known "/usr/share/wordlists/rockyou.txt" dictionary, we can find passwords like "arisDAN13032008", "[email protected]"... So it`s about reuse, not about complexity.

Not even sure how that one person got D. The answer is A all the way. Complexity refers to how the password needs to be formatted.

It is A

According to guidance offered by the National Institute of Standards and Technology (NIST), password length is more important than password complexity. This actually makes a lot of sense as longer passphrases take longer to crack, and they are easier to remember than a string of meaningless characters. NIST has provided a number of additional recommendations for organizations to follow, some of which include: - Passphrases should consist of 15 or more characters. - Uppercase, lowercase, or special characters are not required. - Only ask users to change their passwords if you believe your network has been compromised. - Check all new passwords against a list of passwords that are frequently compromised. - Avoid locking your users out of their accounts after a number of unsuccessful login attempts, as hackers will often try to flood networks by purposely trying incorrect passwords in order to lock users out of their accounts. - Don’t allow password “hints.” www.lepide.com I'm inclined to go for option D

Agree with A here