Password Security and Management Flashcards

What is multi-factor authentication (MFA)?

Answer: Requiring two or more verification factors to access an account

MFA requires users to provide two or more distinct types of evidence (factors) before granting access, making unauthorized logins much harder.

Which of the following is an example of a 'something you have' authentication factor?

Answer: A one-time code sent to your phone

A one-time code sent to your phone represents the 'something you have' factor because it requires physical possession of your device.

What is a dictionary attack in the context of passwords?

Answer: An automated attempt to crack passwords using a list of common words and phrases

A dictionary attack cycles through a list of common words, phrases, and known passwords to guess a user's credential.

How often should passwords be changed for sensitive accounts?

Answer: Only when there is a suspected breach or compromise

Current NIST guidelines recommend changing passwords only when there is evidence of compromise, rather than on a fixed schedule that leads to weak incremental changes.

What is a brute-force attack on a password?

Answer: Trying every possible combination of characters until the correct password is found

A brute-force attack systematically tests every possible character combination until the correct password is discovered.

What does it mean when a website stores passwords as 'hashed'?

Answer: Passwords are converted into a fixed-length string that cannot be reversed to the original

Hashing converts a password into an irreversible digest, so even if the database is stolen, the original passwords cannot be directly recovered.