CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What is 'Multi-Factor Authentication' (MFA) and why does it substantially increase security over single-factor?
- A.MFA requires entering a password twice from two different devices
- B.MFA is only required for admin accounts and does not improve regular user security
- C.MFA requires two or more distinct categories of authentication factor: something you know (password), something you have (authenticator app, hardware key), or something you are (biometrics). An attacker who steals a password still cannot authenticate without the second factor
- D.MFA means the password must be at least 8 characters (multi-factor of 8)
Why C is correct
MFA eliminates the single point of failure that passwords represent. Even perfect password hygiene can be undermined by phishing, keyloggers, or database breaches. With MFA, stolen passwords alone are insufficient - the attacker also needs the second factor (which they typically don't have). Microsoft reports MFA blocks 99.9% of automated account compromise attacks. Authenticator apps and FIDO2 keys are more secure than SMS OTP.
Know someone studying for Web App Fundamentals? Send them this one.