Da8e9 contains the uppercase letter D, the lowercase letters a and e, and the digits 8 and 9, so it does satisfy the character-type condition (at least one uppercase letter, one lowercase letter, and one digit). However, it is only 5 characters long, so it fails the length condition of “6 characters or more”. Even when all character types are present, too few characters means a smaller total number of combinations to try, which makes it weak against brute-force attacks, so it is inappropriate under the rule. Note that the condition is met only when both the length and the character types are satisfied.
×Incorrectイ
Hdfpfgh is 7 characters long, so it satisfies the length condition, but it contains only the uppercase letter H and the lowercase letters d, f, p, f, g, h — not a single digit. The rule requires at least one each of uppercase letters, lowercase letters, and digits, so this string, which lacks digits, is inappropriate. Making a password long using letters only does not raise its strength much, because the range of characters used is narrower.
○ウ
正解The correct answer is ウ, “W28t53”. This question is based on sub-question group C (the rules for writing business reports in the General Affairs Department of Company S). Those rules state that a password set on a file of highly confidential related materials must be “at least 6 single-byte alphanumeric characters” and must “include at least one uppercase letter, one lowercase letter, and one digit each”. You only need to check two points in order: (1) is the length 6 characters or more, and (2) are all three character types (uppercase, lowercase, digit) present. Option ウ, W28t53, consists of W, 2, 8, t, 5, 3 — exactly 6 characters — so it satisfies condition (1); it contains the uppercase letter W, the lowercase letter t, and the digits 2, 8, 5, 3, so all three character types appear at least once and condition (2) is also satisfied. Each of the other three options fails one of the conditions, so ウ is the only one that conforms to the rule. Note that these requirements — “a certain minimum length” and “a mix of several character types” — are also a basic idea of password design: they increase the number of combinations that a brute-force attack must try, and they avoid simple strings that a dictionary attack could guess.
×Incorrectエ
z32e2bk is 7 characters long and contains the lowercase letters z, e, b, k and the digits 3, 2, 2, but not a single uppercase letter. Even though it satisfies the length and two of the character types (lowercase letters and digits), the moment it lacks uppercase letters it fails the condition of including all three character types, so it is inappropriate. It has more characters than ウ, but the key point is that the character-type requirement cannot be substituted by extra length.
ここがポイント
Whether a password is appropriate is judged mechanically against the given password policy (here, the rules of sub-question group C: at least 6 single-byte alphanumeric characters, with at least one uppercase letter, one lowercase letter, and one digit each). The procedure is: first count the characters, then check one by one whether there is at least one uppercase letter, one lowercase letter, and one digit. The conditions are joined by “and”, so if even one of them is missing, that option is eliminated.
The basics of a secure password are: sufficient length; a mix of character types such as uppercase letters, lowercase letters, and digits (and symbols where possible); and avoiding easily guessed strings such as names, birthdates, or dictionary words. Increasing the length and the variety of character types dramatically increases the number of combinations that must be tried, making the password stronger against brute-force attacks and dictionary attacks.