CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
A web application allows users to reset their passwords by answering a security question ('What is your mother's maiden name?'). Why is this considered a weak authentication factor?
- A.Security questions cannot be stored securely
- B.The answers are often guessable from public information (social media, public records) or obtainable via social engineering
- C.They require additional hardware; SMS one-time codes are the phishing-resistant factor class, since possession of the SIM cannot be proxied by a fake site; TOTP codes are pushed from the server to the authenticator app over TLS, and a network outage disables the second factor
- D.Security questions are too hard for users to remember
Why B is correct
Security questions have low entropy: answers like names, pets, schools are often posted on social media or obtainable with minimal research. They do not qualify as a true 'something you know' second factor. NIST SP 800-63 discourages security questions entirely.
Know someone studying for Web App Fundamentals? Send them this one.