A security policy states that common words should not be used as passwords. A security auditor was able to
perform a dictionary attack against corporate credentials. Which of the following controls was being violated?


A. Password complexity
B. Password history
C. Password reuse
D. Password length