What makes an account password more resistant to guessing?
A A familiar name
B A repeated short number
C Length and uniqueness
D The service name alone
Answer: C. Length and uniqueness. Long, unique passwords are harder to guess and limit damage from reuse.
Why use a different password for every service?
A It makes sign-in faster
B One breach cannot unlock others
C MFA becomes unnecessary
D It prevents phishing emails
Answer: B. One breach cannot unlock others. Unique passwords prevent a breached password from opening other accounts.
How can a password manager help?
A Create and store unique passwords
B Send passwords to websites
C Remove account recovery
D Disable two-factor authentication
Answer: A. Create and store unique passwords. Password managers can generate and store distinct credentials for different services.
What does a passphrase usually combine?
A A birthday and name
B The same short code
C A common dictionary phrase
D Several unrelated words
Answer: D. Several unrelated words. A longer memorable phrase of unrelated words can be easier to use and harder to guess.
Which password choice should be avoided?
A A long unique phrase
B A manager-generated secret
C A common or compromised password
D A service-specific password
Answer: C. A common or compromised password. Common, expected, or breached passwords are easier for attackers to guess.
Why is password reuse risky?
A It slows account recovery
B Attackers try leaked passwords elsewhere
C It changes browser settings
D It blocks secure autofill
Answer: B. Attackers try leaked passwords elsewhere. Credential stuffing uses stolen login pairs against other websites and services.
What does a password blocklist help prevent?
A Known weak or breached choices
B All account takeovers
C Every phishing attempt
D Lost recovery devices
Answer: A. Known weak or breached choices. NIST recommends checking new passwords against known common, expected, or compromised values.
What does NIST emphasize more than character-mix rules?
A A required symbol
B A monthly color code
C One uppercase letter only
D Password length
Answer: D. Password length. NIST's current guidance emphasizes length and discourages arbitrary composition requirements.
Which statement about required character mixtures is accurate?
A They guarantee strong passwords
B They stop password reuse
C They are not always beneficial
D They block phishing sites
Answer: C. They are not always beneficial. NIST advises against arbitrary composition rules because users often respond predictably.
When should a password generally be changed?
A Every fixed few weeks
B After evidence of compromise
C Whenever the screen locks
D After each successful login
Answer: B. After evidence of compromise. NIST says periodic forced changes are unnecessary without evidence of compromise.
What is single-factor password authentication?
A Password is the only factor
B Password plus a security key
C Fingerprint plus PIN
D A passkey and face scan
Answer: A. Password is the only factor. A single-factor sign-in relies on the password without an additional factor.
According to NIST, what minimum may apply to single-factor passwords?
A Six characters
B Four characters
C Eight characters
D Fifteen characters
Answer: D. Fifteen characters. NIST SP 800-63B-4 requires at least 15 characters when a password is used as a single factor.
What minimum can NIST permit when password is part of MFA?
A Four characters
B Five characters
C Eight characters
D Three characters
Answer: C. Eight characters. NIST allows shorter passwords within MFA but sets an eight-character minimum in that case.
Why should services allow long passwords?
A Long passwords expose accounts
B Long passphrases need room
C They prevent account recovery
D They disable password managers
Answer: B. Long passphrases need room. NIST recommends permitting at least 64 characters to support long passwords and passphrases.
What should a service do with a known compromised password?
A Reject it and request another
B Store it as a hint
C Send it by email
D Allow it with a warning
Answer: A. Reject it and request another. NIST recommends blocking known compromised or commonly used password choices.
Why avoid using personal details in passwords?
A They increase encryption
B They reduce account alerts
C They prevent account recovery
D They are guessable
Answer: D. They are guessable. Birthdays, names, and public details can be guessed or found by attackers.
What is multifactor authentication?
A Two similar passwords
B A long password alone
C Two different factor types
D A password hint and email
Answer: C. Two different factor types. MFA combines different kinds of evidence, such as something known and something possessed.
Which pair is not two distinct factors?
A Password and security key
B Password and PIN
C Password and fingerprint
D Passkey and authenticator
Answer: B. Password and PIN. A password and PIN are both knowledge factors and do not form two different factor types.
How can MFA reduce account takeover risk?
A It adds another verification step
B It guarantees no attacker succeeds
C Passwords become unnecessary
D It blocks every phishing link
Answer: A. It adds another verification step. A second factor can stop an attacker who only knows the password.
Which MFA method is more phishing-resistant?
A A code sent by SMS
B A reused backup code
C A password hint
D A passkey or security key
Answer: D. A passkey or security key. Passkeys and security keys can provide phishing-resistant authentication.
What is a limitation of SMS verification codes?
A They encrypt all devices
B They prevent phishing
C SIM swaps may expose them
D They cannot be intercepted
Answer: C. SIM swaps may expose them. SMS codes may be exposed through number takeover or real-time phishing.
What is a passkey designed to replace?
A The account recovery process
B A traditional password sign-in
C A device operating system
D A Wi-Fi security key
Answer: B. A traditional password sign-in. Passkeys use cryptographic credentials tied to a service and can replace passwords.
Why is a passkey less vulnerable to phishing?
A Bound to the genuine site
B It is sent by text
C It uses a shorter secret
D It is stored in email
Answer: A. Bound to the genuine site. Passkey authentication is bound to the legitimate website or app origin.
Where should recovery codes be stored?
A In a public profile
B Beside the password online
C Inside a shared chat
D Somewhere separate and secure
Answer: D. Somewhere separate and secure. Recovery codes can restore access, so keep them protected and separate from the account.
What should be done with backup authentication codes?
A Post them for safekeeping
B Reuse one on every site
C Use each only as intended
D Email codes to support
Answer: C. Use each only as intended. Recovery codes are sensitive and usually intended for limited or one-time use.
Why enable account sign-in alerts?
A They encrypt old passwords
B They reveal unfamiliar access attempts
C They stop every login
D They increase storage quota
Answer: B. They reveal unfamiliar access attempts. Alerts help users notice activity that may require investigation.
How can a password manager detect a fake login page?
A It checks the website domain
B It reads the screen color
C It blocks all pop-ups
D It changes the browser history
Answer: A. It checks the website domain. Autofill usually depends on the site address, so it may not fill on an impostor domain.
What should users do if a password manager will not autofill?
A Paste into every prompt
B Disable the manager
C Send the password to support
D Check the website address
Answer: D. Check the website address. Unexpected autofill behavior is a reason to verify the domain before entering credentials.
Why should passwords never be shared in ordinary messages?
A It slows the internet
B It blocks password resets
C Messages may be forwarded
D It removes MFA automatically
Answer: C. Messages may be forwarded. Messages can be stored, intercepted, or forwarded beyond the intended recipient.
What is a safer way to grant temporary account access?
A Send the master password
B Use delegated access controls
C Share a recovery code
D Disable sign-in alerts
Answer: B. Use delegated access controls. Use service features that grant limited access without revealing the main credential.
What is password hashing for?
A Storing a one-way verifier
B Encrypting a Wi-Fi network
C Sending codes by SMS
D Creating browser bookmarks
Answer: A. Storing a one-way verifier. Services should store protected password verifiers rather than readable passwords.
Why should a unique salt be used in password storage?
A It reveals the original password
B It sends hashes to users
C It replaces rate limits
D It makes hashes less reusable
Answer: D. It makes hashes less reusable. Salts make identical passwords produce different stored hashes and frustrate precomputed attacks.
What does login rate limiting reduce?
A Offline file corruption
B Cloud storage use
C Repeated online guessing attempts
D Screen lock timeouts
Answer: C. Repeated online guessing attempts. Rate limits slow repeated login attempts against an account.
How can an account defend against credential stuffing?
A Reuse the leaked password
B Use unique passwords and MFA
C Disable sign-in alerts
D Share login details widely
Answer: B. Use unique passwords and MFA. Unique credentials and MFA reduce the chance that leaked passwords will succeed elsewhere.
What should happen after a service reports a password breach?
A Change that unique password promptly
B Wait for yearly rotation
C Reuse it on another account
D Post it to a forum
Answer: A. Change that unique password promptly. Change the affected credential and any reused variants, then check account activity.
Why is a password hint a weak recovery method?
A It creates a second factor
B It encrypts account data
C It blocks login attempts
D It may reveal the secret
Answer: D. It may reveal the secret. Hints can expose clues to anyone who can view them.
What is risky about security questions?
A They are always phishing-resistant
B They remove account passwords
C Answers may be discoverable
D They create unique passwords
Answer: C. Answers may be discoverable. Answers based on public or personal facts may be guessed or researched.
Which method is safer for account recovery?
A A public social media post
B Verified recovery email or key
C A shared household password
D A guessed security answer
Answer: B. Verified recovery email or key. Use current recovery options controlled by the account owner and protect them carefully.
Why should a recovery email be secured separately?
A It can reset other accounts
B It increases password length
C It blocks service updates
D It changes the username
Answer: A. It can reset other accounts. An attacker who controls the recovery mailbox may reset the connected account.
What is a common sign of a phishing login message?
A A known bookmark
B A saved password prompt
C A service's official app
D Unexpected urgency and link
Answer: D. Unexpected urgency and link. Urgency and unexpected links are warning signs; navigate to the service independently.
How should a user respond to an unsolicited login link?
A Enter the password quickly
B Reply with a verification code
C Visit the service directly
D Forward the link to friends
Answer: C. Visit the service directly. Open the official app or a saved address instead of the unexpected link.
Why can MFA approval fatigue be dangerous?
A It makes passwords longer
B Prompts may be approved accidentally
C It hides login locations
D It turns on encryption
Answer: B. Prompts may be approved accidentally. Unexpected repeated prompts may pressure a user into approving a malicious attempt.
What should users do with an MFA prompt they did not request?
A Deny it and check activity
B Approve it to dismiss
C Share the code with support
D Disable account alerts
Answer: A. Deny it and check activity. Deny unexpected approvals and investigate through the official account settings.
Why keep password-manager software updated?
A They reveal saved passwords
B They remove MFA
C They disable encryption
D Updates can fix security flaws
Answer: D. Updates can fix security flaws. Updates may address vulnerabilities in the manager and its browser integrations.
What should be considered before syncing a password vault?
A The wallpaper color
B The device screen size
C Account security and recovery
D The Wi-Fi network name
Answer: C. Account security and recovery. A synced vault depends on strong account protection and reliable recovery.
How can autofill reduce password reuse?
A It removes all passwords
B It makes unique passwords easier
C It blocks every fake site
D It replaces account recovery
Answer: B. It makes unique passwords easier. Convenient autofill supports using separate generated passwords rather than memorizing one password.
What should be avoided when setting a new account password?
A Reusing a breached secret
B Using a manager-generated password
C Choosing a longer passphrase
D Turning on available MFA
Answer: A. Reusing a breached secret. A password exposed in a breach should not be reused.
Which response best protects a compromised account?
A Change the wallpaper
B Clear the browser cache
C Disable recovery methods
D Reset credentials and revoke sessions
Answer: D. Reset credentials and revoke sessions. Change the password, remove suspicious sessions, and review recovery and MFA settings.
Why are passwords not phishing-resistant by themselves?
A They are always too short
B They cannot be stored securely
C Fake sites can capture them
D They block all malicious links
Answer: C. Fake sites can capture them. A person can be tricked into entering a password on an attacker-controlled site.
What should an organization do after detecting credential compromise?
A Wait for scheduled rotation
B Require a prompt credential change
C Keep using the password
D Store it in a hint
Answer: B. Require a prompt credential change. NIST recommends forcing password changes when there is evidence of compromise.