Which components should be included in a strong password policy, and how do you implement lockout safeguards?

• A. Password length only.
• B. Lockouts should never occur.
• C. Minimum length, complexity, rotation/history, expiration, breach detection; lockout after failed attempts with defined timeout and an admin unlock path.
• D. No rotation policy.

Answer: (C)

A strong password policy needs multiple layers to be effective: length and complexity to resist guessing, policies that govern how passwords change over time, mechanisms to detect when credentials may have been compromised, and safeguards that stop repeated guessing without locking out legitimate users unnecessarily.

Minimum length and complexity make passwords harder to crack; requiring a mix of character types (uppercase, lowercase, digits, symbols) increases the search space. Rotation/history prevents reusing recent passwords, and expiration enforces timely updates so compromised credentials aren’t usable for too long. Breach detection helps identify if a password has appeared in a known leak, triggering resets and alerts. Lockout after several failed attempts with a defined timeout, plus an admin unlock path, stops automated guessing while ensuring a legitimate user can recover access.

The other options miss important pieces: focusing on length alone neglects complexity, rotation, and breach detection; stating that lockouts should never occur removes a key defense against brute-force and credential-st stuffing; and a policy with no rotation leaves credentials at risk even if they were once strong.