Passphrases of more than one decently-sized word strung together are the exception to the rule that complexity is better than length when choosing a secure password. As of June 2017, the NIST guidelines on secure passwords have been rewritten and they now recommend a long passphrase instead. (SOURCES: https://gizmodo.com/the-guy-who-invented-those-annoying-password-rules-now-1797643987 https://nakedsecurity.sophos.com/2017/08/11/why-nists-bill-burr-shouldnt-regret-his-2003-password-advice/ https://howsecureismypassword.net )

::COMMENT:: Is this what is on the Security+ test though? A previous question points to complexity with upper/lower case, numbers and special chars. Despite what NIST says, this is test prep, we need to know what is correct for the test.

::COMMENT2:: Irrelevant sources: this is a question CompTIA is asking, not NIST. According to CompTIA, a strong password will consist of the following: - minimum of 8 characters - Capital letters - Lowercase letters - Numbers - Special characters

If you are taking the SY0-401 then 7eH1./%H9nPc$ Is correct but there are no correct answers for SY0-501: Passwords should not be so long or complex that they are difficult to remember. This question should be revised to fit the CompTIA SY0-501 as well as the SY0-401 exams. Sources: Course: Pluralsight SY0-501 Security+ Book: Prowse, David L. "CompTIA Security+ SY0-501 Cert Guide." Pearson IT Certification, 2017 Website: https://www.certblaster.com/strong-passwords-as-defined-by-comptia-objectives/ Website: http://blogs.getcertifiedgetahead.com/creating-strong-passwords/