CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A web application allows users to reset their passwords by answering a security question ('What is your mother's maiden name?'). Why is this considered a weak authentication factor?
- A.Security questions are too hard for users to remember
- B.The answers are often guessable from public information (social media, public records) or obtainable via social engineering
- C.Security questions cannot be stored securely
- D.They require additional hardware
Why B is correct
Security questions have low entropy: answers like names, pets, schools are often posted on social media or obtainable with minimal research. They do not qualify as a true 'something you know' second factor. NIST SP 800-63 discourages security questions entirely.
Know someone studying for Web App Fundamentals? Send them this one.