Cyber Security Quiz: Authentication Factors And Mfa
10 questions · exam conditions
0:00
Authentication Factors And MfaQuestion 1 of 10

A banking application requires a password and a hardware security key. A customer who reports a lost key can regain access by giving a support agent a billing address and the last four digits of a government identifier. The agent can then disable MFA and issue a password-reset link.

What is the most significant weakness in this design?

The hardware key is unsuitable because possession factors cannot be used for account recovery
The recovery process can bypass stronger authentication using easily obtained personal information
The password-reset link adds an unnecessary third factor after the customer answers questions
The lost hardware key must remain enabled until the customer registers a replacement key
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Authentication Factors And Mfa

Practice Authentication Factors And Mfa in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Authentication Factors And Mfa, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A banking application requires a password and a hardware security key. A customer who reports a lost key can regain access by giving a support agent a billing address and the last four digits of a government identifier. The agent can then disable MFA and issue a password-reset link.

What is the most significant weakness in this design?

  1. The hardware key is unsuitable because possession factors cannot be used for account recovery
  2. The recovery process can bypass stronger authentication using easily obtained personal information (correct answer)
  3. The password-reset link adds an unnecessary third factor after the customer answers questions
  4. The lost hardware key must remain enabled until the customer registers a replacement key
Explanation: When evaluating authentication system security, you need to think beyond the primary login mechanism and examine the entire authentication lifecycle — including account recovery. A system is only as strong as its weakest path to access. The core problem here is that the application establishes strong two-factor authentication (password + hardware key), but then provides a recovery path that completely sidesteps it. A billing address and partial government ID are considered "knowledge factors," but they're also semi-public, easily researched, or obtainable through social engineering. This makes B correct: the recovery process effectively downgrades robust MFA to weak knowledge-based authentication, creating a bypass that attackers can exploit without ever obtaining the hardware key. Looking at the distractors: A is factually wrong — possession factors like hardware keys are widely used and accepted in MFA designs. The problem isn't the type of factor; it's the recovery mechanism around it. C misidentifies the issue entirely — the password-reset link isn't a "third factor"; it's simply the mechanism for resetting credentials after identity is verified. Criticizing it distracts from the real vulnerability. D raises a minor operational concern, but leaving the old key active temporarily is far less dangerous than having a recovery path that bypasses MFA entirely using guessable information. As a study tip, always trace the full authentication flow when answering questions like this, including edge cases like recovery, lockouts, and support escalations. Attackers target these paths precisely because designers focus on the primary login and neglect the fallback routes.

Question 2

An employee enters a password into a corporate application and then enters a time-based one-time password generated by an authenticator app on the same smartphone used to access the application.

How should the security team characterize this arrangement?

  1. It is not 2FA because both authentication steps occur on the same physical device
  2. It is 2FA by factor category, but compromise of one device may expose both steps (correct answer)
  3. It is single-factor authentication because both entries are values the user types manually
  4. It is three-factor authentication because the phone, password, and one-time code are separate
Explanation: When evaluating multi-factor authentication (MFA), the critical rule is that factors are defined by category — something you know, something you have, and something you are — not by how many separate actions you perform or how many devices are involved. Here, the employee uses a memorized password (something you know) and a TOTP generated by an authenticator app (something you have — the phone itself is the possession factor). Those are genuinely two distinct factor categories, which makes this true 2FA. However, because both the corporate application and the authenticator app run on the same smartphone, a single point of compromise — a stolen or malware-infected device — could expose both factors simultaneously. That nuance makes B the most accurate and complete characterization. A is wrong because the definition of 2FA doesn't require separate physical devices. A single device can host two different factor types. The physical-device rule is a security best-practice consideration, not a definitional requirement for MFA classification. C misunderstands factor categories entirely. The fact that the user types both entries doesn't collapse them into one factor. The TOTP derives its security from physical possession of the enrolled device, placing it in the "something you have" category regardless of how it's entered. D overcounts the factors. The phone is not an independent third factor — it's the mechanism that generates the "something you have" factor. Listing the device, the password, and the code as three separate factors conflates a tool with the factor itself. Study tip: On security exams, always classify factors by category (know/have/are), then separately evaluate whether the implementation is secure — these are two different questions.

Question 3

A company is introducing mandatory MFA. During first login, any user who supplies a correct password may register a new mobile authenticator without confirming an existing factor or completing additional identity proofing. Many employee passwords were exposed in an earlier breach.

Which control would best address the primary risk during MFA enrollment?

  1. Require shorter one-time-code intervals after the new authenticator has been registered
  2. Send a notice after enrollment while allowing the newly registered factor immediate access
  3. Allow enrollment only from browsers that have disabled password-manager extensions
  4. Require proof with an existing trusted factor or a separately verified enrollment process (correct answer)
Explanation: When a question involves authentication enrollment, your first instinct should be to identify when the system is most vulnerable — and enrollment is exactly that moment. If an attacker already knows a user's password (as in a credential breach), and the system lets anyone with a valid password register a new authenticator, then MFA provides zero additional protection at the most critical step. This is why D is correct. Requiring proof of an existing trusted factor — or a separate, out-of-band identity verification process — closes the window that a credential-stuffing attacker would exploit. The whole point of MFA is layered verification; skipping that layer during enrollment itself defeats the purpose before it even begins. A is a distractor that sounds security-conscious but addresses the wrong phase entirely. Shorter OTP intervals harden an already registered authenticator against interception — they do nothing to prevent an unauthorized person from registering one in the first place. B describes a reactive "notification after the fact" approach. Alerting the legitimate user is useful, but by then the attacker's rogue authenticator is already active and has immediate access. Notification without blocking is damage assessment, not prevention. C is a red herring. Disabling password managers is a browser-level restriction that has no meaningful relationship to enrollment security — and it would actually harm legitimate users by making strong, unique passwords harder to use. The study tip here: watch for questions where a new security control is being implemented, because exams frequently probe the bootstrapping problem — how do you securely establish a new credential when no trusted credential yet exists? The answer almost always involves some pre-existing verified identity anchor.

Question 4

A cloud service permits access after a valid password when the request comes from a managed laptop, a familiar network, and the user's usual geographic region. No additional credential or authenticator is requested. Administrators describe this process as MFA because three conditions are evaluated.

Which assessment of the administrators' claim is most accurate?

  1. It is MFA because device posture, network location, and geography are three possession factors
  2. It is MFA because evaluating multiple independent risk conditions is equivalent to using multiple factors
  3. It is not MFA because the contextual signals affect risk but do not add another authentication factor (correct answer)
  4. It is not authentication because contextual signals can never be considered during an access decision
Explanation: When you see a question about MFA, anchor yourself to the formal definition: Multi-Factor Authentication requires presenting credentials from at least two distinct factor categories — something you know, something you have, and something you are. The key word is factor, not condition or signal. In this scenario, the user provides one credential (a password — something you know), and the system silently evaluates three contextual signals: device posture, network location, and geographic region. These signals inform a risk engine about the trustworthiness of the request, but they are never presented by the user as proof of identity. No second factor is ever verified. That's why C is correct — contextual signals adjust the risk score and can suppress or trigger step-up authentication, but they don't constitute authentication factors themselves. The system is more accurately described as risk-based or adaptive access control layered on top of single-factor authentication. A is wrong because device, network, and geography are not "possession factors." A possession factor is something you physically hold and actively demonstrate, like a hardware token or a one-time code sent to your phone. Passively detected signals don't qualify. B is wrong because it conflates evaluating conditions with verifying factors. Counting the number of checks performed does not determine whether MFA has occurred — category and active verification do. D goes too far. Contextual signals are legitimately used in access decisions all the time (zero-trust architectures depend on them); they just don't substitute for authentication factors. Study tip: On exam questions about MFA, always ask: Is the user actively proving something from a second category? If the answer is no, it isn't MFA — regardless of how many background checks the system performs.

Question 5

A laboratory uses fingerprint-only authentication for access to sensitive research systems. After fingerprint templates associated with several employees are exposed, management proposes requiring users to enroll a different finger and continuing with biometric-only authentication.

Which response is the most appropriate long-term improvement?

  1. Retain biometric-only login because enrolling a different finger fully restores secrecy and revokes the exposed template
  2. Hash each fingerprint with the employee's username so that the stored template becomes unique and revocable per system
  3. Combine local biometric verification with a bound possession factor and add liveness protections against presentation attacks (correct answer)
  4. Replace fingerprints with security questions because knowledge factors are not subject to physical capture or replication
Explanation: When a question asks about recovering from a biometric credential breach, think through two distinct problems: revocability and attack surface. Unlike passwords, biometrics are permanent — you can't issue someone new fingerprints — so the architecture around them matters enormously. Option C is correct because it addresses both problems systematically. Pairing local biometric verification with a bound possession factor (like a hardware security key or smart card) means that capturing a fingerprint template alone is no longer sufficient to gain access — an attacker also needs the physical token. Adding liveness detection closes the presentation-attack vector, where adversaries use spoofed fingerprints (printed replicas, gelatin molds) against the scanner. This is a true defense-in-depth solution that remains sound even after future template exposure. Option A fails because enrolling a different finger does not revoke the exposed template on other systems, and biometric-only authentication still has a single point of failure. You haven't changed the fundamental vulnerability — you've just delayed it. Option B sounds technically clever, but hashing with a username doesn't protect against someone who already has the raw fingerprint image or a working spoof. It also doesn't prevent presentation attacks and doesn't add a second factor — it only makes cross-system correlation harder. Option D is a step backward. Security questions are among the weakest knowledge factors — answers are often guessable, publicly discoverable, or socially engineered. Replacing a flawed biometric with a weaker knowledge factor violates the principle of improving, not just changing, security. Your study tip: on exam questions about biometric systems, remember the mantra — biometrics establish identity, but they must be paired with revocable factors to remain secure long-term.

Question 6

Users authenticate to a payroll portal with a password and a phishing-resistant hardware key. A malware infection steals a manager's authenticated session cookie after login. The attacker then uses that cookie to submit a bank-account change without being prompted again.

Which control would most directly reduce the risk demonstrated in this scenario?

  1. Require step-up authentication with transaction details before sensitive account changes (correct answer)
  2. Require the manager to use two different passwords during the initial portal login
  3. Increase the hardware key's PIN length while preserving the existing session behavior
  4. Extend the session lifetime so fewer hardware-key authentications are required each day
Explanation: When you see a scenario where an attacker bypasses multi-factor authentication by stealing a session cookie, your mental flag should be: "The authentication was fine — the problem is what happens after login." This question tests whether you understand the difference between securing the login event versus securing sensitive actions within an authenticated session. The attack here is classic post-authentication session hijacking. The manager's hardware key and password worked perfectly — but once the session cookie was stolen, the attacker inherited the full trusted session and changed bank details without any additional verification. The fix must interrupt the attacker at the point of the sensitive action, not at the door. Option A does exactly this: step-up authentication forces re-verification with transaction-specific details before a high-risk change is committed, meaning a stolen cookie alone is no longer sufficient. Option B is a trap — using two passwords replaces one factor type with more of the same. It adds no new authentication layer, and it still only protects the initial login, leaving the session just as hijackable. Option C increases the hardware key's PIN length but explicitly preserves the existing session behavior, meaning the stolen cookie still grants the attacker full access after the stronger login. Harder to log in ≠ harder to exploit a stolen session. Option D actively worsens security by extending session lifetime, giving attackers a larger window to exploit a hijacked cookie. Study tip: On security exams, watch for scenarios where the breach occurs after a strong login. That's your cue that the answer involves protecting individual transactions or actions, not hardening the authentication event itself.

Question 7

Employees authenticate with a password and a mobile push notification. Attackers who obtain passwords repeatedly send approval requests until some employees approve one merely to stop the notifications. The organization must retain its current push platform for the next quarter.

Which change would most directly reduce the success of this attack without replacing the push platform?

  1. Require number matching between the login screen and the approval prompt (correct answer)
  2. Increase password length while leaving push approvals as one-tap actions
  3. Shorten each push request's expiration period from five minutes to one minute
  4. Send the push request to two registered phones instead of one phone
Explanation: This question tests your understanding of MFA fatigue attacks (also called push bombing), where attackers flood a victim with approval prompts until frustration causes accidental or deliberate approval. The key insight is: what makes the attack succeed? The victim approves a request without verifying it's legitimate, because all prompts look identical regardless of whether the victim initiated a login. Number matching (answer A) directly breaks this mechanism. The login screen displays a code — say, "47" — and the push notification requires the user to select that same number before approving. An attacker's fraudulent push arrives without a matching code on the victim's screen, so approving it becomes an obvious, conscious error rather than a reflexive tap. This adds cognitive verification without replacing the push platform, which is exactly what the constraint demands. Answer B increases password complexity, but the attacker already has the password — the attack exploits the push step, not credential theft. Longer passwords solve the wrong problem entirely. Answer C shortens the expiration window from five minutes to one minute, which slightly inconveniences the attacker but doesn't stop them — they can simply send more requests per minute, and fatigued employees will still approve one to silence the flood. Answer D sends the request to two phones, which actually expands the attack surface; either device can approve, giving attackers two chances per attempt rather than one. A useful study habit: when evaluating MFA controls, always ask which step of authentication is being exploited — then confirm your chosen control actually addresses that specific step, not an adjacent one.

Question 8

An organization requires privileged users to authenticate with two distinct factor categories. The security team is comparing several proposed login designs.

Which design most directly satisfies the requirement while avoiding reliance on two credentials from the same factor category?

  1. A memorized password followed by a separately memorized six-digit PIN
  2. A facial scan followed by fingerprint recognition on the same workstation
  3. A cryptographic smart card activated by a user-entered PIN (correct answer)
  4. A hardware token followed by approval from a registered mobile phone
Explanation: When a question asks about multi-factor authentication (MFA), your first instinct should be to recall the three factor categories: something you know (passwords, PINs), something you have (tokens, smart cards), and something you are (biometrics). Genuine MFA requires credentials from at least two different categories — not simply two credentials total. Option C — a cryptographic smart card activated by a user-entered PIN — is the correct design because it combines something you have (the physical smart card) with something you know (the PIN). These are distinct categories, and critically, neither works without the other: the card is useless without the PIN, and the PIN alone provides no access without the card. This is the textbook definition of two-factor authentication done correctly. Option A fails because a memorized password and a memorized PIN both belong to something you know. Using two credentials from the same category is single-factor authentication, regardless of how many prompts appear. Option B combines a facial scan and a fingerprint — both are biometrics, meaning both fall under something you are. Again, two factors from one category. Option D might look appealing since a hardware token (something you have) seems paired with a mobile phone (also something you have). Both credentials belong to the possession category, so this also remains single-factor. A useful rule of thumb: count categories, not credentials. On exam questions, watch for distractors that present two steps or two devices while keeping both within the same factor category — that's the classic trap this question is testing.

Question 9

Four system administrators share one emergency account. Its password is stored in a sealed vault, and its hardware token is kept in a locked cabinet. Access to both items is logged, but the application itself records all activity under the same account name.

Which conclusion about this arrangement is most accurate?

  1. It provides two authentication factors but weakens individual accountability within the application (correct answer)
  2. It provides individual accountability because possession of the token uniquely identifies each administrator
  3. It is single-factor authentication because the password and token are stored at the same facility
  4. It eliminates nonrepudiation concerns because the vault and cabinet both generate access logs
Explanation: When a question describes a shared account, you should immediately think about two separate security properties: authentication strength (how many factors verify identity) and accountability (whether actions can be traced to a specific individual). This scenario uses a password (something you know) and a hardware token (something you have) — that's genuine two-factor authentication, so the system's login security is solid. However, once inside the application, every action is logged under the same shared account name. If Administrator 2 deletes a critical file, the log simply says "emergency account deleted the file." There's no way to distinguish which of the four admins was responsible. This is the core problem: authentication and accountability are not the same thing. A makes exactly this point — strong MFA at the door, but poor individual accountability inside — which is why A is correct. B is wrong because possessing the token only proves someone with access to the cabinet logged in; since four people share that access, the token doesn't uniquely identify any single individual within the application's activity logs. C misidentifies the authentication factor count. The fact that both items are stored at the same facility doesn't collapse them into a single factor. Factor classification is about type (knowledge, possession, inherence), not physical location. D confuses physical access logs with application-level nonrepudiation. Knowing someone opened the cabinet doesn't prove who performed which action inside the application — nonrepudiation requires being able to bind specific actions to specific individuals, and shared accounts defeat that entirely. Study tip: On security exams, always separate authentication (who got in) from accountability/nonrepudiation (who did what). Shared accounts are a classic trap for weakening the latter even when authentication is strong.

Question 10

A company deploys passkeys. During registration, a device creates a site-specific public-private key pair. At login, the device releases a signed response only for the legitimate site's domain after the employee unlocks the credential with a local fingerprint. The fingerprint template remains on the device.

Which statement best explains the security properties of this design?

  1. The fingerprint is sent to the site as a shared secret, making the login vulnerable to biometric database theft
  2. The passkey combines a bound authenticator with local user verification and resists credential phishing (correct answer)
  3. The design relies only on inherence because the private key merely stores a copy of the fingerprint
  4. The design is equivalent to a reusable password because the same signed response is transmitted at each login
Explanation: Whenever you see a question about modern authentication schemes like passkeys, focus on the three classic authentication factors — knowledge (something you know), possession (something you have), and inherence (something you are) — and ask how the design combines them and what threats it defeats. Passkeys work through asymmetric cryptography. During registration, the device generates a site-specific key pair; the private key never leaves the device. At login, the device signs a challenge using that private key, but only after the user passes local biometric verification. Because the signature is bound to a specific domain, a phishing site on a different domain simply cannot obtain a valid signed response. This is exactly what B describes: a bound authenticator (the device holding the private key) combined with local user verification (the fingerprint unlock) that structurally resists phishing. A gets the architecture backwards. The fingerprint never leaves the device — it is never transmitted to the site at all, let alone as a shared secret. There is no biometric database on the server side to steal. C confuses the role of the private key. The private key is a cryptographic credential, not a copy or encoding of the fingerprint. The fingerprint is simply the unlock mechanism that releases use of the key locally. D is wrong because the signed response is never the same twice. Each login challenge is fresh, so the signature changes every session — this is the opposite of a reusable password. As a study tip, remember that passkeys eliminate shared secrets entirely: nothing reusable or stealable travels over the network, which is precisely what makes them phishing-resistant by design.