Fundamentals of Multi-Factor Authentication and 2FA Quiz

Explore the basics of multi-factor authentication (MFA) and two-factor authentication (2FA) with this quiz, designed to help you understand key terms, types, and practical applications in digital security. Strengthen your knowledge of authentication methods and how they protect online accounts from unauthorized access.

1. Definition of MFA

   Which option best describes multi-factor authentication (MFA)?

   1. Using two or more independent credentials to verify a user’s identity
   2. Automatically saving your passwords in a browser
   3. Logging in with just a username and password
   4. Allowing guest access without verification

   Explanation: The correct answer describes MFA as requiring two or more independent credentials, which adds layered security. Logging in with only a username and password is single-factor authentication, not MFA. Saving passwords in a browser is a convenience feature, not an authentication process. Allowing guest access without verification doesn’t involve any authentication at all, so it is incorrect.

2. 2FA in Practice

   If you log in by entering a password and then confirm a code sent to your phone, what authentication method are you using?

   1. Password autofill
   2. Multi-session authentication
   3. Single sign-on
   4. Two-factor authentication (2FA)

   Explanation: This scenario is an example of 2FA, where two different verification steps are used: something you know (password) and something you have (your phone). Single sign-on allows access to multiple systems with one login, but does not necessarily involve a second factor. Password autofill automatically enters saved credentials and is not a form of authentication. Multi-session authentication is not a commonly used authentication term.

3. Types of Authentication Factors

   Which list correctly describes the three main types of authentication factors used in MFA?

   1. Something you write, something you send, something you say
   2. Something you know, something you have, something you are
   3. Something you guess, something you receive, something you tell
   4. Something you see, something you hear, something you find

   Explanation: The commonly accepted three types are: something you know (like a password), something you have (like a phone), and something you are (like a fingerprint). The other options include factors that are not used in standard authentication security models, such as seeing or guessing, making them incorrect.

4. Security Benefit

   Why does enabling MFA make an online account more secure?

   1. It makes your internet speed faster
   2. It requires more than one proof of identity, making unauthorized access harder
   3. It prevents all types of malware infections
   4. It saves your login information for easier access

   Explanation: MFA adds security by demanding multiple proofs of identity, reducing the risk if one factor is compromised. MFA does not prevent malware infections or improve internet speed, as these are unrelated to authentication. Saving login information is a convenience, not a security measure.

5. Common 2FA Method

   When asked to enter a code from a text message after logging in with your password, which type of factor is being used next?

   1. Something you are
   2. Something you create
   3. Something you have
   4. Something you know

   Explanation: A code from a text message is an example of 'something you have' — your phone or device receiving the code. 'Something you know' would refer to passwords or PINs. 'Something you are' means a biometric factor like a fingerprint. 'Something you create' is not established authentication terminology.

6. PINs and 2FA

   Does entering a PIN code right after your password usually qualify as two-factor authentication?

   1. No, only if the PIN is biometric
   2. Yes, because two steps are better than one
   3. Yes, if the PIN is very strong
   4. No, because both are considered 'something you know'

   Explanation: Both passwords and PINs are knowledge-based factors, not different categories, so this typically does not meet 2FA criteria. Two steps alone do not define two-factor authentication; the factors must be from different categories. The strength of the PIN or its use as 'biometric' (which it is not) does not change the authentication factor type.

7. Strongest MFA Setup

   Which combination provides the strongest multi-factor authentication?

   1. Password, security question, and date of birth
   2. Username, favorite word, and email address
   3. Password, fingerprint, and a authentication app code
   4. PIN, phone number, and postal address

   Explanation: This option uses three different factors: something you know (password), something you are (fingerprint), and something you have (app code), which is ideal for strong MFA. The other combinations use duplicate or weak factors, such as personal details or information that’s easy to find or guess, thus not meeting true MFA standards.

8. Authenticator Apps

   If you use an app to generate login codes, what MFA factor is this?

   1. Something you are
   2. Something you have
   3. Something you memorize
   4. Something you write

   Explanation: Code-generating apps on devices fall under 'something you have.' They require physical possession of the device to access the code. 'Something you memorize' is not standard; memorization is related to passwords. 'Something you are' refers to biometrics, and 'something you write' is not an authentication factor.

9. Knowledge Factor

   Which of the following is an example of the 'something you know' factor in authentication?

   1. Your ID badge
   2. Your facial recognition scan
   3. Your password
   4. Your key fob

   Explanation: 'Something you know' means information only the user should know, such as a password or PIN. A key fob and ID badge are physical items, so they fit under 'something you have.' A facial recognition scan is 'something you are,' involving biometric data.

10. Phishing and MFA

    How does MFA help protect against phishing attacks on user accounts?

    1. It replaces the need for strong passwords
    2. It guarantees your account cannot be hacked
    3. It completely prevents all phishing emails from being delivered
    4. Even if a password is stolen, additional verification is required

    Explanation: MFA adds a layer of security because attackers need both your password and access to the other authentication factor. It does not stop phishing emails from arriving, nor does it eliminate the need for strong passwords. While MFA greatly increases protection, no security method guarantees an account cannot be compromised.