An organization deploys CIS Benchmarks for Windows 10 hardening. One control recommends setting 'Minimum password length' to 14 characters. An administrator argues this will cause user complaints. What is the security justification for this control?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because password length exponentially increases the keyspace an attacker must search in an offline brute-force or dictionary attack, making longer passwords dramatically more resistant to cracking. B is wrong because password length does not protect against phishing; MFA addresses that threat.
Full explanation below image
Full Explanation
A is correct because password length exponentially increases the keyspace an attacker must search in an offline brute-force or dictionary attack, making longer passwords dramatically more resistant to cracking. B is wrong because password length does not protect against phishing; MFA addresses that threat. C is wrong because Kerberos authentication works with any valid password; it has no specific length requirement. D is wrong because NIST SP 800-63B recommends a minimum of 8 characters for memorized secrets and encourages longer passwords but does not mandate exactly 14 characters.