CSCU Password Security and Management 2 — Questions and Answers
Question 1: What is multi-factor authentication (MFA)?
- Using multiple passwords for one account
- Requiring two or more verification factors to access an account (Correct answer)
- Having multiple accounts for security
- Logging in from multiple devices simultaneously
Correct answer: Requiring two or more verification factors to access an account
MFA requires users to provide two or more distinct types of evidence (factors) before granting access, making unauthorized logins much harder.
Question 2: Which of the following is an example of a 'something you have' authentication factor?
- Your password
- Your fingerprint
- A one-time code sent to your phone (Correct answer)
- Your username
Correct answer: A one-time code sent to your phone
A one-time code sent to your phone represents the 'something you have' factor because it requires physical possession of your device.
Question 3: What is a dictionary attack in the context of passwords?
- An attack using definitions from a dictionary website
- An automated attempt to crack passwords using a list of common words and phrases (Correct answer)
- A social engineering technique involving technical jargon
- An attack on spell-check software
Correct answer: An automated attempt to crack passwords using a list of common words and phrases
A dictionary attack cycles through a list of common words, phrases, and known passwords to guess a user's credential.
Question 4: How often should passwords be changed for sensitive accounts?
- Never, once set it's secure
- Only when there is a suspected breach or compromise (Correct answer)
- Every day
- Every year regardless of circumstances
Correct answer: Only when there is a suspected breach or compromise
Current NIST guidelines recommend changing passwords only when there is evidence of compromise, rather than on a fixed schedule that leads to weak incremental changes.
Question 5: What is a brute-force attack on a password?
- Physically threatening someone to reveal their password
- Trying every possible combination of characters until the correct password is found (Correct answer)
- Tricking users into entering passwords on fake websites
- Exploiting software bugs to bypass authentication
Correct answer: Trying every possible combination of characters until the correct password is found
A brute-force attack systematically tests every possible character combination until the correct password is discovered.
Question 6: What does it mean when a website stores passwords as 'hashed'?
- Passwords are stored in plain text for easy retrieval
- Passwords are converted into a fixed-length string that cannot be reversed to the original (Correct answer)
- Passwords are encrypted with a key held by the company
- Passwords are deleted after first login
Correct answer: Passwords are converted into a fixed-length string that cannot be reversed to the original
Hashing converts a password into an irreversible digest, so even if the database is stolen, the original passwords cannot be directly recovered.
CSCU Password Security and Management 2
What is multi-factor authentication (MFA)?