City Guilds Model Questions Vol1 2021 Information Technology Question 31

The IT policy requires passwords of exactly 12 characters chosen from the set of 26 uppercase letters, 26 lowercase letters, 10 digits and 10 special symbols (total 72 characters). A valid password must contain at least one character from each of the four categories and must not contain the substring "2023". (a) Determine the minimum entropy (in bits) of a password that satisfies the policy, assuming characters are selected uniformly from the allowed set and the "2023" restriction is ignored for the entropy calculation. (b) An attacker can test \(10^{12}\) password guesses per second. Using the number of possible passwords from part (a), compute the expected time (in years, rounded to the nearest whole year) to exhaust the search space. (c) The organisation's security target is at least 80 bits of entropy **and** an expected cracking time greater than 1 year. State whether a password meeting the policy satisfies the target ("Meets" or "Does not meet").