How would you implement password policy requirements in a directory?

• A. Set minimum length, complexity, expiration, history, and lockout thresholds; enforce SSPR.
• B. Allow any password.
• C. Enforce only expiration.
• D. Never lock accounts.

Answer: (A)

Strengthening how passwords are managed in a directory requires a multi-faceted policy that governs how passwords are created, changed, and protected. The most effective approach sets a minimum length and enforces complexity so passwords aren’t easily guessable, requires regular expiration to limit the window of exposure if a password is compromised, and uses a history check so old passwords aren’t reused. Adding lockout thresholds helps defend against automated guessing by temporarily blocking an account after too many failed attempts. Enforcing self-service password reset ensures users can recover access securely through a controlled process, reducing helpdesk workload and keeping resets aligned with the policy. Together, these elements create a robust, defense-in-depth password strategy.

Options that allow any password, enforce only expiration, or never lock accounts fail to address common attack vectors like weak credentials, offline or online guessing, and account abuse, which is why they’re not sufficient on their own.