Authentication Methods & Security Policies Flashcards

What is the purpose of Multi-Factor Authentication (MFA)?

Answer: Verify identity using multiple factors

Multi-Factor Authentication (MFA) is a security enhancement that requires users to provide two or more distinct types of verification factors to prove their identity. Instead of relying solely on a password, MFA combines 'something you know' (like a password), 'something you have' (like a phone or token), or 'something you are' (like a fingerprint). This layered approach significantly strengthens security by making it much harder for unauthorized users to gain access.

Which of the following is a common factor in MFA?

Answer: Fingerprint

MFA factors are typically categorized into knowledge (something you know), possession (something you have), and inherence (something you are). A fingerprint falls under the 'something you are' category, known as an inherence factor. It is a common and highly secure biometric method used in MFA to verify a user's identity.

What is adaptive authentication?

Answer: Adjusts authentication based on risk

Adaptive authentication, also known as risk-based authentication, dynamically adjusts the level of authentication required based on contextual factors and the perceived risk of a login attempt. For instance, if a user logs in from an unusual location or device, the system might prompt for an additional MFA factor. This approach balances strong security with user convenience by only requiring stronger authentication when necessary.

What is a security policy in Okta?

Answer: Authentication rule set

In Okta, a security policy is a defined set of rules that dictate how users authenticate and what access they are granted. These policies specify requirements for passwords, Multi-Factor Authentication (MFA), session lifetimes, and conditional access based on factors like network, device, or location. They are fundamental to enforcing an organization's security posture and ensuring compliance.

Which protocol is commonly used in Okta for authentication?

Answer: OAuth 2.0

OAuth 2.0 is an authorization framework commonly used in Okta for delegated authorization. It allows applications to obtain limited access to user accounts on an HTTP service without sharing the user's credentials directly. While SAML and OpenID Connect are also crucial for authentication and SSO, OAuth 2.0 specifically enables secure, token-based authorization for API access and resource sharing.

How are authentication factors managed in Okta?

Answer: Via admin security policies

In Okta, authentication factors, including which MFA factors are available and when they are required, are managed and enforced via admin security policies. These policies allow administrators to define granular rules based on user groups, network zones, device types, and application sensitivity. This provides comprehensive control over the organization's authentication security posture.

Which Okta feature helps prevent brute-force attacks?

Answer: Account lockout

Account lockout is a critical security feature implemented in Okta to prevent brute-force attacks. It automatically disables or locks a user account after a specified number of consecutive failed login attempts. This mechanism thwarts attackers from repeatedly guessing passwords, thereby protecting user accounts from unauthorized access.

How does Okta handle password policies?

Answer: Via security policy configuration

Okta handles password policies through its robust security policy configuration, allowing administrators to define strict rules for user passwords. These policies can enforce requirements such as minimum length, complexity (e.g., uppercase, lowercase, numbers, special characters), password history, and expiration periods. This ensures strong password hygiene and enhances overall security across the organization.

Which user group can be assigned a specific security policy?

Answer: Any defined user group

Okta's security policies are highly flexible and can be assigned to any defined user group within the Okta environment. This granular control allows administrators to implement specific authentication requirements and access rules tailored to different departments, roles, or risk profiles. For example, a group of privileged users might be assigned a stricter MFA policy than general employees.