Which of the following controls BEST ensures a user creates a complex password?

Operating system rules are the most effective control for ensuring a user creates a complex password. These are technical enforcement mechanisms, such as Group Policy Objects (GPO) in Windows or Pluggable Authentication Modules (PAM) in Linux. Administrators can configure these rules to mandate specific password requirements, including minimum length, a mix of character types (uppercase, lowercase, numbers, symbols), and history, physically preventing users from setting non-compliant passwords.

B. Multi-factor authentication adds another layer of security but does not control or enforce the complexity of the password component itself.
C. Information security awareness training can educate and encourage users to create strong passwords, but it cannot technically enforce compliance or prevent the use of a weak password.
D. Biometrics is an authentication method that uses physical characteristics (e.g., fingerprint) as an alternative or supplement to a password, not a control to enforce password complexity.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. Control IA-5, "Authenticator Management," p. 178. (Specifies technical enforcement of password complexity and composition rules).

2. ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO01.05, "Manage a system of internal control." (Implies the need for technical controls to enforce policies like password complexity).

3. Microsoft. (2023). Password Policy Documentation. (Official vendor documentation detailing the operating system-level settings, such as "Password must meet complexity requirements," that technically enforce password rules). Retrieved from Microsoft Learn.