Blair Receives Permission to Audit the Passwords on a Critical

Multiple Choice

Blair receives permission to audit the passwords on a critical server. The server is joined to a domain and is therefore "Kerberized" but Blair decides to try the simplest approach first anyway. He uses pwdump to successfully obtain the hashes and john the ripper to crack them. Blair's supervisor is stunned. He says "I made sure every password was at least 10 characters long"
Why did the audit fail?

A) Blair used a terabyte sized dictionary file he downloaded from the Internet
B) The effective length of the passwords was only 7 characters.
C) Blair used "AllCrack2008" the most powerful cracking tool available
D) Blair used a hacked version of John the Ripper that is "forensic" strength.