While reviewing the security controls in place for a web-based application, a security controls assessor notices that there are no password strength requirements in place. Because of

this vulnerability, passwords might be easily discovered using a brute force attack.

Which of the following password requirements will MOST effectively improve the security posture of the application against these attacks? (Select two)

A. Minimum compl

exity

B. Maximum age limit

C. Maximum length

D. Minimum length

E. Minimum age limit

F. Minimum re-use limit