4 Multi-Factor Authentication Free Online FlashCards

What makes authentication multi-factor?

MFA requires proof from at least two different categories: something you know, something you have, or something you are.

Why is a password plus an authenticator-app code MFA?

A password plus a one-time code from an authenticator app combines something you know with something you have.

How does MFA help if a password is stolen?

MFA makes a stolen password less useful, but it does not replace the need for secure passwords.

What controls an authenticated IAM user's permissions?

IAM policies and roles govern what resources a user may access; MFA does not determine those permissions.

Which MFA options should you prefer for AWS sign-in?

Prefer a passkey or FIDO security key when available. Public-key cryptography makes these options phishing-resistant and helps prevent fake sign-in pages from reusing authentication.

How does an IAM user begin MFA setup in the AWS console?

In the AWS Management Console, open IAM, select the user's Security credentials, choose Assign MFA device, name it, select its type, and follow the setup prompts.

How should you prepare for losing an MFA device?

Keep the setup secret private and register more than one MFA device where practical. If a device is lost or compromised, use the service's recovery process promptly and ask an administrator to remove or replace it.

What does enabling root-user MFA protect?

Root-user MFA is configured separately and protects only the root user; it does not enable MFA for IAM users.

How should you respond to an unexpected MFA prompt?

Deny prompts you did not initiate, and never share a one-time code or approve a request on someone else's behalf.

Does using two passwords count as MFA?

No. Both passwords are something you know, so they do not represent two different factor categories.

What is a security limitation of TOTP codes?

Authenticator apps and hardware tokens can generate time-based one-time passcodes (TOTP), but a user can be tricked into giving a code to an attacker who relays it.

Does AWS support enabling SMS-based MFA?

AWS no longer supports enabling SMS-based MFA.