An administrator discovers that many users have used their same passwords for years even though the
network requires that the passwords be changed every six weeks. Which of the following, when used
together, would BEST prevent users from reusing their existing password? (Select TWO).

A.
Length of password

B.
Password history

C.
Minimum password age

D.
Password expiration

E.
Password complexity

F.
Non-dictionary words

Explanation:
In this question, users are forced to change their passwords every six weeks. However, they are able to
change their password and enter the same password as the new password.
Password history determines the number of previous passwords that cannot be used when a user
changes his password. For example, a password history value of 5 would disallow a user from changing his
password to any of his previous 5 passwords.
When a user is forced to change his password due to a maximum password age period expiring, (the
question states that the network requires that the passwords be changed every six weeks) he could
change his password to a previously used password. Or if a password history value of 5 is configured, the
user could change his password six times to cycle back round to his original password. This is where the
minimum password age comes in. This is the period that a password must be used for. For example, a
minimum password age of 30 would determine that when a user changes his password, he must continue
to use the same password for at least 30 days.
Incorrect Answers:A: The length of password determines how many characters a password must contain. It will not prevent
users from changing their passwords multiple times to cycle back to their original passwords.
D: Password expiration determines how long a password can be used for before it must be changed. In
this question, the password expiration is 6 weeks. Password expiration will force users to change their
passwords but it will not prevent users from changing their passwords multiple times to cycle back to
their original passwords.
E: Password complexity determines what a password should include. For example, you could require a
password to contain uppercase and lowercase letters and numbers. . It will not prevent users from
changing their passwords multiple times to cycle back to their original passwords.
F: Non-dictionary words is a setting that determines that a password should not be a word that can be
found in a dictionary. This is to prevent a “dictionary attack” where software can be used to attempt to
access a system by using the words of a dictionary as the password.

https://technet.microsoft.com/enus/library/cc757692%28v=ws.10%29.aspx#w2k3tr_sepol_accou_set_kuwh