Which statement best describes the book's stance on password length and complexity?

• A. Complexity matters only
• B. Both length and complexity matter
• C. Length matters only
• D. Neither matter

Answer: (B)

Password strength comes from the amount of uncertainty an attacker faces. Both how long the password is and how varied its characters are contribute to that uncertainty. A longer password increases the total number of possible combinations dramatically, which slows down brute-force attempts. At the same time, using a mix of character types—uppercase, lowercase, numbers, and symbols—adds variety and makes each guess less likely to hit, especially against common wordlists or patterns. If you rely only on complexity with a short password, you still fall quickly to fast guessing; if you rely only on length but keep the password to simple or common phrases, attackers can exploit those patterns. Combining a long password with a good mix of character types provides the strongest protection, which is why the statement that both length and complexity matter is the best fit.