Comp TIA Security + Certification Questions Part 3

While reviewing the security controls in place for a web-based application, a security controls assessor notices that there are no password strength requirements in place. Because of this vulnerability, passwords might be easily discovered using a brute force attack.
Which of the following password requirements will MOST effectively improve the security posture of the application against these attacks? (Select two)