Download [MFAE] Multi Factor Authentication Essentials Certification Exam Preparation and more Exams Technology in PDF only on Docsity!
Certification Exam Preparation
Question 1. Which of the following best describes the “knowledge” factor in multi-factor authentication? A) A hardware token that generates codes B) A fingerprint scan C) A password or PIN D) A push-notification approval Answer: C Explanation: The knowledge factor relies on something the user knows, such as a password or personal identification number. Question 2. In the context of authentication, what does the “possession” factor represent? A) A secret answer to a security question B) A smartphone that receives a one-time code C) A facial recognition scan D) The user’s typing rhythm Answer: B Explanation: Possession refers to something the user has, like a device that can receive or generate a one-time password. Question 3. Which statement correctly differentiates identification, authentication, and authorization? A) Identification verifies permissions, authentication confirms identity, authorization grants access. B) Identification is claiming an identity, authentication proves it, authorization determines what the identity can do. C) Authentication is the same as identification, and authorization is optional. D) Authorization occurs before identification.
Certification Exam Preparation
Answer: B Explanation: Identification is the claim of an identity, authentication is the proof of that claim, and authorization defines the allowed actions. Question 4. How does “contextual authentication” improve security? A) By requiring a longer password B) By adding a third factor based on location or behavior C) By disabling MFA for trusted devices D) By storing passwords in plain text Answer: B Explanation: Contextual (or adaptive) authentication adds security based on dynamic factors like geolocation or user behavior. Question 5. Which of the following is a time-based one-time password (TOTP) algorithm? A) HMAC-based OTP (HOTP) B) RSA SecurID C) Google Authenticator code generation D) SMS delivery of a code Answer: C Explanation: Google Authenticator implements the TOTP standard, generating codes based on the current time. Question 6. What is the primary security weakness of SMS-based MFA? A) It requires a physical token. B) SMS messages can be intercepted or redirected via SIM swapping. C) It uses asymmetric cryptography.
Certification Exam Preparation
C) The system is very fast. D) The biometric template is stored securely. Answer: B Explanation: FAR measures the likelihood that an unauthorized person is incorrectly accepted. Question 10. Which of the following best describes an “out-of-band” (OOB) authentication method? A) A code generated on the same device as the login page. B) A secondary verification performed via a separate communication channel, such as a phone call. C) Using a longer password. D) Storing the OTP in a browser cookie. Answer: B Explanation: OOB uses a different channel (e.g., voice call, email) to deliver the secondary factor. Question 11. What is the main advantage of using TOTP over HOTP? A) TOTP does not require a shared secret. B) TOTP codes expire after a short time, reducing replay risk. C) HOTP is more resistant to phishing. D) TOTP can be delivered via SMS only. Answer: B Explanation: TOTP codes are time-limited, which limits the window for replay attacks compared to counter-based HOTP.
Certification Exam Preparation
Question 12. Which XML-based standard is commonly used for federated identity between an IdP and a SP? A) OpenID Connect B) SAML 2. C) OAuth 2. D) Kerberos Answer: B Explanation: SAML 2.0 uses XML to exchange authentication and authorization data between identity and service providers. Question 13. In OAuth 2.0, what is the purpose of an “access token”? A) To authenticate the user to the identity provider. B) To grant the client permission to access a protected resource. C) To store the user’s password. D) To encrypt the communication channel. Answer: B Explanation: An access token represents the client’s authorization to call a protected API on behalf of the user. Question 14. Which protocol is primarily used for network device (VPN, router) authentication and supports MFA extensions? A) SAML B) RADIUS C) OIDC D) LDAP Answer: B
Certification Exam Preparation
Answer: B Explanation: Downgrade attacks coerce the service into falling back to a less secure factor. Question 18. Which of the following best describes “session hijacking” in the context of MFA? A) Stealing the user’s password from a database. B) Capturing a valid session cookie to bypass re-authentication. C) Intercepting an OTP sent via email. D) Modifying the OTP algorithm. Answer: B Explanation: Session hijacking steals an active session token, allowing the attacker to act as the authenticated user without re-entering credentials or MFA. Question 19. What is the primary purpose of Risk-Based Authentication (RBA)? A) To require MFA for every login regardless of risk. B) To increase password length automatically. C) To trigger additional authentication steps only when the login context is deemed risky. D. To replace all MFA methods with biometrics. Answer: C Explanation: RBA evaluates risk factors (device, location, behavior) and applies “step-up” authentication when needed. Question 20. Which regulatory framework explicitly mandates MFA for remote access to cardholder data environments? A) GDPR
Certification Exam Preparation
B) HIPAA
C) PCI-DSS
D) SOX
Answer: C Explanation: PCI-DSS requires MFA for remote access to environments that store, process, or transmit cardholder data. Question 21. In Azure AD (Entra ID), which MFA method is considered “passwordless”? A) SMS code B) Email OTP C) Microsoft Authenticator push approval with biometric unlock D) Hardware token Answer: C Explanation: The Authenticator app can provide passwordless sign-in using push approval combined with device biometrics. Question 22. Which of the following is a common challenge when integrating MFA with legacy applications? A) Legacy apps often lack support for modern protocols, requiring a wrapper or proxy. B) Legacy apps automatically enforce MFA. C) Legacy apps can only use biometric factors. D) Legacy apps store MFA tokens in the cloud by default. Answer: A Explanation: Older systems may not understand SAML/OIDC, so an MFA proxy or wrapper is needed.
Certification Exam Preparation
Answer: C Explanation: Step-up authentication escalates security when risk indicators suggest a higher threat. Question 26. In the context of MFA, what does “FIDO2” primarily eliminate? A) The need for a password. B) The need for a network connection. C) The need for encryption. D) The need for user consent. Answer: A Explanation: FIDO2 enables passwordless authentication by relying on public-key cryptography and hardware authenticators. Question 27. Which of the following is a common metric used to evaluate biometric systems? A) Token expiration time B) False Rejection Rate (FRR) C) Password entropy D) Session timeout length Answer: B Explanation: FRR measures the likelihood that a legitimate user is incorrectly denied access. Question 28. Which attack vector specifically targets the delivery channel of SMS-based OTPs? A) Phishing B) Man-in-the-middle on TLS
Certification Exam Preparation
C) SIM swapping D) Brute-force password guessing Answer: C Explanation: SIM swapping hijacks the mobile number, allowing attackers to receive SMS OTPs. Question 29. What is the purpose of a “remember this device” setting in MFA implementations? A) To permanently disable MFA for the device. B) To reduce friction by extending the authentication session for trusted devices. C) To store the user’s password on the device. D) To allow the device to generate its own OTPs. Answer: B Explanation: The setting lets a device be trusted for a defined period, reducing repeated MFA prompts. Question 30. Which standard defines the use of JSON Web Tokens (JWT) for authentication and authorization? A) SAML B) OIDC C) RADIUS D) LDAP Answer: B Explanation: OpenID Connect (OIDC) builds on OAuth 2.0 and uses JWTs to convey identity information. Question 31. In a MFA deployment, what is the primary benefit of using hardware security keys (e.g., YubiKey) over software OTP generators?
Certification Exam Preparation
Question 34. What does the “counter” in an HOTP algorithm represent? A) The current time in seconds. B) The number of OTPs generated so far. C) The length of the password. D) The number of failed login attempts. Answer: B Explanation: HOTP uses a moving counter that increments each time an OTP is generated. Question 35. Which of the following is a key difference between “factors” and “channels” in MFA terminology? A) Factors refer to the type of credential; channels refer to the delivery method. B) Factors are always hardware; channels are always software. C) Factors are only biometric; channels are only SMS. D) There is no difference; the terms are interchangeable. Answer: A Explanation: A factor (knowledge, possession, inherence) defines what is used; a channel (SMS, email, push) defines how it is delivered. Question 36. In the context of API security, which MFA approach is most suitable for machine-to-machine communication? A) Push notification to a human user. B) Non-interactive certificate-based authentication (mTLS). C) Voice call verification. D) CAPTCHA challenge. Answer: B
Certification Exam Preparation
Explanation: Mutual TLS uses client certificates, providing strong, non-interactive MFA for APIs. Question 37. Which of the following best mitigates the risk of “phishing-in-the-middle” attacks that capture OTPs? A) Using only SMS OTPs. B) Implementing FIDO2/WebAuthn where the authenticator binds the credential to the origin. C) Increasing OTP length to 12 digits. D) Requiring users to write down OTPs. Answer: B Explanation: Origin-bound credentials (FIDO2) prevent attackers from replaying captured OTPs on malicious sites. Question 38. What is the main purpose of “MFA enrollment” self-service portals? A) To allow users to disable MFA for their accounts. B) To enable users to register their own authentication factors securely. C) To store passwords in clear text. D) To generate unlimited OTPs for all users. Answer: B Explanation: Self-service enrollment streamlines the secure registration of devices, tokens, or biometrics. Question 39. Which of the following compliance standards specifically requires MFA for privileged access to cloud resources? A) GDPR B) SOC 2
Certification Exam Preparation
A) Hardware tokens are cheaper. B) Hardware tokens are less susceptible to malware that can extract secret seeds. C) Hardware tokens require an internet connection. D) Hardware tokens can be easily shared among users. Answer: B Explanation: Hardware tokens store the secret in a tamper-resistant device, reducing exposure to software attacks. Question 43. Which authentication factor would be considered “something you do”? A) A fingerprint scan. B) A password. C) Typing cadence analysis. D) A smart card. Answer: C Explanation: “Something you do” refers to behavioral patterns such as keystroke dynamics. Question 44. In the context of MFA, what does “fallback authentication” refer to? A) The primary method used for every login. B) An alternative method used when the primary factor is unavailable. C) Disabling MFA for a user. D) Using a longer password instead of MFA. Answer: B Explanation: Fallback authentication provides a secondary way to authenticate when the preferred factor cannot be used.
Certification Exam Preparation
Question 45. Which of the following is a key characteristic of “time-synchronised” OTP algorithms? A) They require a shared secret and a moving counter. B) They generate codes based on the current Unix time slice. C) They depend on the device’s GPS location. D) They are delivered via email only. Answer: B Explanation: TOTP uses the current time (e.g., 30-second intervals) combined with a secret key to produce OTPs. Question 46. Which of the following best describes the “principle of least privilege” in the context of MFA? A) Users should have as many authentication factors as possible. B) Users should be granted only the minimal access needed, and MFA should protect those privileged accounts. C) All users must use the same MFA method. D) MFA should be disabled for low-risk users. Answer: B Explanation: Least privilege limits access rights; MFA adds a strong barrier to the privileged accounts that exist. Question 47. What is a common mitigation against “SIM swapping” attacks? A) Using only email-based OTPs. B) Enforcing carrier-level PINs and requiring biometric verification for number changes. C) Disabling all mobile devices.
Certification Exam Preparation
A) Users must remember a complex password. B) Authentication relies on a cryptographic key stored on a device or token. C) OTPs are sent via unencrypted email. D) Users are prompted for a security question after each login. Answer: B Explanation: Password-less solutions use hardware or software keys (e.g., FIDO2) instead of passwords. Question 51. Which of the following best explains why “geolocation” can be used as an adaptive authentication factor? A) It replaces the need for any other factor. B) It provides contextual risk information based on where the login originates. C) It stores the user’s password in the cloud. D) It guarantees that the device is not compromised. Answer: B Explanation: Geolocation adds context; anomalous locations trigger higher-risk responses. Question 52. What is the primary purpose of a “certificate revocation list” (CRL) in PKI-based MFA? A) To list all valid certificates. B) To identify certificates that have been compromised or expired and should no longer be trusted. C) To store user passwords. D) To generate OTPs. Answer: B
Certification Exam Preparation
Explanation: A CRL contains certificates that have been revoked, preventing their use in authentication. Question 53. Which MFA method is most resistant to “man-in-the-middle” attacks on public Wi-Fi? A) SMS OTP B) Email OTP C) FIDO2/WebAuthn with origin binding D) Voice call OTP Answer: C Explanation: FIDO2 binds the credential to the originating domain, making MitM attacks ineffective. Question 54. In an OAuth 2.0 flow, which token type is typically short-lived and used to access resources? A) Refresh token B) Access token C) ID token D) Authorization code Answer: B Explanation: Access tokens grant resource access and usually have brief lifetimes. Question 55. Which of the following is a key advantage of “software-based OTP generators” (e.g., Google Authenticator) over “SMS-based OTPs”? A) They require no initial setup. B) They are not dependent on cellular networks, reducing exposure to SIM-swap attacks.
