Gce Model Questions Vol1 2022 Computer Studies Question 35

An organization enforces a password policy that requires passwords to be at least 8 characters long and to include at least one uppercase letter, one lowercase letter, one digit and one special character. Assume the allowed character set consists of 26 uppercase letters, 26 lowercase letters, 10 digits and 10 special characters (total 72 characters). An attacker can try \(10^{6}\) passwords per second. (a) Assuming passwords are chosen uniformly at random from all possible 8‑character strings that meet the policy, estimate the average time in days for a successful brute‑force attack on a single account. (b) The organization has 10 000 accounts and mandates a password change every 90 days. Based on the calculated average attack time, discuss whether the mandatory 90‑day password change is ethically justified, considering the risk of compromise.