A city Active Directory policy allows short passwords. What impact should the assessment highlight?
Select an answer to reveal the explanation.
Short Explanation
Short passwords are like flimsy bike locks—fine until someone actually tries. Weak policy makes guessing and cracking far more realistic once hashes or login surfaces are in play. Policy is part of the attack surface, not just an IT preference.
Full Explanation
When city Active Directory policy allows short passwords, the assessment should highlight that weak length and complexity policies make credential attacks more likely to succeed, including offline cracking when hashes are obtained. Short domain passwords are not a cosmetic local-account issue; domain policy shapes the quality of credentials across municipal workloads. Claiming AD password length settings have no relationship to offline attack feasibility contradicts how hash cracking difficulty scales with entropy. Preferring short passwords to reduce helpdesk reset volume trades operational convenience for systemic identity risk and is not a sound security rationale. Exam caveat: policy weakness is a root-cause finding even before a specific account is cracked in the lab portion of an engagement. Operational check: export or screenshot the effective password policy settings in scope, compare against the city’s stated standard, and show how the weak policy increases success likelihood for spray and offline analysis themes without dumping cleartext secrets into the main report. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.