Which three statements are true about the security authentication of users' passwords?

Password criteria is setup by the system administrator.

Users can change their password via the Settings portlet.

Passwords have strength ratings and cannot be changed until the criterion is met.

The 'reset password' Security Questions are updated by the system administrator.