$9.$ Which of the following activities must the assessor perform to verify that user passwords are being changed as required by PCI DSS$?$

Review system configuration settings to verify passwords must be changed after $90$ days

Require a user to change their password, and return in $60$ days to see if it has expired

Review system configuration settings to verify passwords must be changed after $60$ days

Interviews service desk personnel to verify that user passwords are disabled every $60$ days