Ask a room full of users to invent a password on the spot, and most will produce something like "Company123!" — a word they know, a number, and whatever symbol the form demanded. Attackers know this, and their tools are built around it. The gap between how people pick passwords and how attackers break them is the entire subject of this article.
CompTIA A+ Core 2 (220-1202) covers password best practices under the workstation security and hardening objective in the Security domain. The exam expects you to know what makes a password strong, which policy settings enforce those rules on a Windows machine, why default credentials are dangerous, what BIOS/UEFI passwords protect, and where tools like password managers and multifactor authentication fit. Weak and stolen credentials sit behind a large share of real-world breaches — Verizon's breach research has tied the majority of hacking-related incidents to them for years — so this material earns its place both on the test and on the job.
Length beats complexity, and the math explains why
Password strength comes down to one question: how many guesses would an attacker need to try every possibility? Security people call this entropy, but you don't need the formula to see how it works. Every character you add to a password multiplies the number of combinations by the size of the character set. A password drawn from lowercase letters, uppercase letters, digits, and symbols has roughly 70 to 90 possibilities per position — so each extra character multiplies the attacker's work by 70 or more. An 8-character password, even a complex one, can fall to modern cracking hardware in hours. Stretch it to 14 or 16 characters and the same attack runs for centuries.
This is why passphrases work so well. A string of several unrelated words — the classic example is "correct horse battery staple" — is long enough to be mathematically brutal to guess, yet easy for a human to remember and type. Compare that to "K7#mP$2x!", which is miserable to recall, gets written on a sticky note, and is still shorter and therefore weaker.
Modern guidance has caught up with this math. Current recommendations from the National Institute of Standards and Technology (NIST) favor long passwords, screening against known-breached password lists, and changing passwords only on evidence of compromise. The same guidance moves away from forced composition rules and scheduled expiration every 60 or 90 days, because both push users toward predictable patterns: "Summer2025!" becomes "Autumn2025!" and an attacker who saw the first can guess the second.
Here is the exam nuance, stated plainly: A+ questions may still present the traditional answer as correct. If a question offers the classic checklist — minimum length, mixed character types, no reuse, periodic expiration — pick the traditional best-practice answer. Know both positions: in the real world, length and uniqueness matter most and forced complexity is fading; on the exam, complexity requirements and expiration policies are still legitimate answers when a question frames them as policy settings.
Password policy settings live in Local Security Policy and Group Policy
Understanding strong passwords is theory. Enforcing them is configuration, and the A+ exam expects you to know where those settings live on a Windows machine.
On a standalone workstation, open Local Security Policy (run secpol.msc) and navigate to Account Policies, then Password Policy. In a domain, the same settings are pushed to every machine through Group Policy (Computer Configuration > Windows Settings > Security Settings > Account Policies), which is how one administrator enforces a standard across hundreds of computers at once. The settings are identical in both places:
- Minimum password length — the floor for how short a password can be. Many organizations set 12 to 14 characters; the exam favors longer over shorter.
- Enforce password history — remembers a number of previous passwords (commonly 10 to 24) so users can't cycle back to an old favorite.
- Maximum password age — forces a change after a set number of days. Traditional policy says 90 days or less; modern guidance relaxes this, but the setting still exists and still appears in questions.
- Minimum password age — prevents a user from changing their password ten times in a row to burn through the history list and land back on the original.
- Password must meet complexity requirements — a single on/off setting that requires characters from at least three of the four categories (uppercase, lowercase, digits, symbols) and blocks passwords containing the account name.
The related account lockout settings — locking an account after a set number of failed sign-in attempts — live one node over, under Account Lockout Policy, and are covered in depth in the Account Management article; here, just remember lockout is the policy partner that makes online guessing expensive. For quick command-line auditing, net accounts displays the current policy on a machine.
For the exam, know where these settings are configured and what each does. A scenario that says "users keep reusing their old passwords" points at password history; "users never change their passwords" points at maximum password age.
Every password attack has a control that blunts it
Passwords fail in specific, well-understood ways, and each failure mode has a specific defense — exactly the kind of matching the exam loves.
Online guessing and password spraying. The attacker tries passwords against a live login screen. Classic brute force hammers one account with many guesses; password spraying flips it, trying one or two very common passwords (think "Winter2025!") against many accounts to stay under lockout thresholds. Account lockout blunts brute force, and screening new passwords against breached-password lists blunts spraying by stopping "Winter2025!" from ever being set.
Credential stuffing. Attackers take username-and-password pairs leaked in a breach of one site and replay them against other sites, betting that people reuse passwords. The bet pays off constantly. The control here is uniqueness: a different password for every account means a breach at a shopping site never unlocks the corporate mailbox. No policy setting on your workstation can enforce uniqueness across the internet — only a password manager makes it practical.
Phishing. The attacker doesn't guess the password; they ask for it, with a fake login page or an urgent email. Strength is irrelevant here — a 30-character passphrase typed into a phishing site is captured just as completely as "password1".