Multiple Choice Questions on Two-Factor Authentication (2FA)

📚 Quick Study Guide: Two-Factor Authentication (2FA)

• 🔑 What is 2FA? A security measure that requires two different methods of verification to confirm a user's identity, typically from separate categories of credentials.
• 🛡️ Purpose: To significantly enhance account security by adding an extra layer beyond just a password, making it much harder for unauthorized users to gain access even if they steal a password.
• 🌐 Three Categories of Authentication Factors:
  • 🧠 Something you know: Passwords, PINs, security questions.
  • 📱 Something you have: Physical tokens, smartphones (for TOTP/SMS codes), smart cards.
  • 👁️ Something you are: Biometrics (fingerprint, facial recognition, iris scan).
• ⚙️ Common 2FA Methods:
  • 🔢 SMS Codes: A code sent to a registered mobile number. (Note: Can be vulnerable to SIM swapping).
  • 🕰️ Time-based One-Time Passwords (TOTP): Generated by authenticator apps (e.g., Google Authenticator, Authy) that change every 30-60 seconds.
  • ✨ Physical Security Keys (e.g., YubiKey): Hardware devices that plug into a port or use NFC/Bluetooth. Considered highly secure.
  • 📧 Email Verification: A code sent to a registered email address.
  • ✅ Push Notifications: A prompt on a trusted device to approve or deny a login attempt.
• 🚨 Benefits: Significantly reduces the risk of account compromise from phishing, keyloggers, and brute-force attacks.
• ⚠️ Limitations: Not entirely foolproof; methods like SMS can be vulnerable to specific attacks (e.g., SIM swapping, SS7 attacks).

📝 Practice Quiz: Two-Factor Authentication (2FA)

1. Which of the following best describes the primary goal of Two-Factor Authentication (2FA)?

• A) To replace traditional passwords entirely with biometric methods.
• B) To add an extra layer of security beyond a single password, requiring two different verification factors.
• C) To encrypt all user data stored on a server before transmission.
• D) To ensure that all online transactions are processed anonymously.

2. A user logs into an online banking account by entering their password (something they know) and then providing a fingerprint scan (something they are). This is an example of using factors from which two categories?

• A) Something you know and something you have.
• B) Something you are and something you have.
• C) Something you know and something you are.
• D) Something you do and something you know.

3. Which of the following 2FA methods is generally considered to be among the most secure against phishing and man-in-the-middle attacks?

• A) SMS-based verification codes.
• B) Email-based verification codes.
• C) Time-based One-Time Passwords (TOTP) from a software authenticator.
• D) Physical security keys (e.g., FIDO U2F tokens).

4. What is a potential vulnerability associated with using SMS codes for Two-Factor Authentication?

• A) SMS codes are too long and difficult for users to type quickly.
• B) SMS codes expire too slowly, allowing attackers more time to use them.
• C) SMS messages can be intercepted or redirected through attacks like SIM swapping or SS7 vulnerabilities.
• D) SMS codes require a constant internet connection, which is not always available.

5. An authenticator app like Google Authenticator or Authy typically generates codes based on which 2FA factor category?

• A) Something you know (a secret phrase).
• B) Something you have (the device running the app).
• C) Something you are (biometric data from the device).
• D) Something you do (a specific gesture on the screen).

6. Which statement accurately describes how 2FA enhances security?

• A) It makes passwords stronger by encrypting them before storage.
• B) It eliminates the need for any password, relying solely on biometrics.
• C) It requires an attacker to compromise two distinct authentication factors, significantly increasing difficulty.
• D) It automatically detects and blocks all malware on a user's device.

7. When setting up 2FA, a user is often advised to generate and save 'backup codes'. What is the purpose of these codes?

• A) To share with trusted friends in case the user forgets their password.
• B) To provide an alternative way to access the account if the primary 2FA method (e.g., phone) is lost or unavailable.
• C) To encrypt the user's data in the event of a data breach.
• D) To reset the user's password without needing to verify identity.