IT and Internet Literacy Quiz | Passwords, MFA, and Passkey Security
Problem 1
You use the same password on several shopping sites. If that password leaks from one site, which improvement most reduces the risk that your accounts on other sites will also be taken over?
View explanation
A different password for each service limits the spread of an attack that tries credentials leaked from one site on other sites. Making the same change everywhere leaves the underlying problem of password reuse.
Problem 2
A web service wants to support secure password management without obstructing its users' password managers. Which login-page design is most appropriate?
View explanation
Allowing autofill and pasting makes it practical to use long, unique passwords generated and stored by a password manager. Requiring manual entry can instead encourage simpler passwords or reuse.
Problem 3
An organization is reviewing the password-change policy for a public-facing service. Which approach best reflects current authentication guidance?
View explanation
Password changes should respond to evidence of compromise, such as a leak or unauthorized use, instead of following an arbitrary short schedule. Frequent forced changes can encourage predictable suffix changes or reuse.
Problem 4
During registration, a user chooses a password such as “Password1!” that appears frequently in breach data. What is the most appropriate response by the service?
View explanation
A password found in known breach data is easy for attackers to guess even if it contains uppercase letters, digits, and symbols. Meeting character-type rules alone does not establish safety, and storing passwords in plaintext is also inappropriate.
Problem 5
A login asks for a password and then a separate PIN. Someone says this is MFA because two secrets are entered. Which evaluation is correct?
View explanation
MFA combines distinct factor types, such as knowledge, possession, and biometrics. A password and PIN are both knowledge factors. However, MFA does not require all three types; two distinct factors can be sufficient.
Problem 6
Which statement best describes a passkey?
View explanation
A passkey is a password-replacement technology based on a cryptographic key pair associated with a service. It does not work like an emailed code or by sending a fingerprint image to the server.
Problem 7
You unlock a passkey with the fingerprint reader on your smartphone and sign in to a web service. Which description of the biometric data is most accurate?
View explanation
When biometrics unlock a passkey, the comparison takes place on the device, and the biometric data itself is not sent to the service. The service receives the authentication result after local user verification.
Problem 8
A service gives you a saved recovery code so that you can regain access if your smartphone is lost. Which storage practice is most appropriate?
View explanation
A recovery code is a secret that can restore access when the normal authenticator is unavailable. Store it securely offline, and after use replace the invalidated code with a new one. Saving it in a shared location risks disclosure.
Problem 9
Which login method combines distinct types of authentication factor and therefore qualifies as MFA?
View explanation
The password is a knowledge factor, while the registered device and authenticator app provide a possession factor. A username is an identifier rather than an authentication factor, and two passwords or security answers remain knowledge factors.
Problem 10
An attacker has built a convincing fake login page and immediately relays each password and one-time code entered by a victim to the real site. Which authentication method best improves resistance to this kind of attack?
View explanation
A manually entered one-time code can be relayed from a fake site to the real one in real time. A passkey or another method that cryptographically binds authentication to the legitimate service resists this relay. This does not mean that adding an OTP provides no improvement over a password alone.