Timedora
Free Practice Quiz Question List

4 Multi-Factor Authentication Online Quiz Questions

Use this free practice quiz with 20 questions to review 4 Multi-Factor Authentication, test your knowledge, and prepare for your next test or exam.

20 questions
01
True or false
1 point

True or false: Enabling MFA means a user no longer needs to use a secure password.

  1. A

    True

  2. B

    False

02
True or false
1 point

True or false: Configuring MFA for an AWS account's root user also enables MFA for its IAM users.

  1. A

    True

  2. B

    False

03
Choose one
1 point

Which sign-in combination uses proof from two different MFA factor categories?

  1. A

    A password and a second password

  2. B

    A password and a code from an authenticator app

  3. C

    Two codes generated by the same authenticator app

  4. D

    A password and a security question whose answer is also a password

04
Choose one
1 point

An organization wants an AWS sign-in method that helps prevent an attacker from reusing authentication on a fake sign-in page. Which authenticator should it prefer when available?

  1. A

    A password saved in a browser

  2. B

    An SMS code sent to a phone

  3. C

    A passkey or FIDO security key

  4. D

    A time-based code entered into a sign-in page

05
Choose one
1 point

An IAM user with the required permissions wants to configure MFA for their own account in the AWS Management Console. Which option gives the complete navigation path, authenticator-specific setup steps, and final test?

  1. A

    Sign in to the AWS Management Console and open IAM. Choose your user name, then Security credentials; under Multi-factor authentication (MFA), choose Assign MFA device. Name the device, select its type, and follow the setup prompts. For an authenticator app, scan the displayed QR code and enter the requested consecutive codes; for a passkey or security key, follow the browser prompts and complete the requested device action. Then sign out and back in to confirm the MFA challenge works.

  2. B

    Open IAM, choose Users, select the root user, and assign an MFA device for your IAM user. Then sign out and back in to test the challenge.

  3. C

    Open IAM roles, choose the account's billing settings, and assign an MFA device. Scan the QR code for any authenticator type, then sign back in.

  4. D

    Open Security credentials without first opening IAM, choose Assign MFA device, and name the device. Setup is complete without verifying it by signing out and back in.

06
Choose one
1 point

A user loses a device registered for MFA. What is the appropriate response to restore access securely?

  1. A

    Keep trying the lost device until it becomes available

  2. B

    Use the recovery process and ask an administrator to remove or replace the device

  3. C

    Give a colleague the setup secret so they can sign in

  4. D

    Disable all account protections and leave them disabled

07
Choose all
1 point

A user is signing in and receives an MFA prompt they did not initiate. Select all actions consistent with secure sign-in practices.

  1. A

    Check that the sign-in address is the genuine service page

  2. B

    Approve an unexpected MFA prompt if it appears more than once

  3. C

    Deny an MFA prompt the user did not initiate

  4. D

    Never tell anyone a one-time code or approve a request on someone else's behalf

  5. E

    Enter a one-time code into any page that requests it

08
Choose all
1 point

An administrator is helping an IAM user configure an authenticator. Select all steps or precautions that are appropriate.

  1. A

    Keep the authenticator's setup secret private

  2. B

    Complete the on-screen steps for the selected authenticator type

  3. C

    Share the setup secret with a colleague to make recovery easier

  4. D

    Sign out and sign back in to confirm the MFA challenge works

  5. E

    Assume setup worked without testing a sign-in

09
Written response
1 point

What acronym names the time-based one-time passcodes generated by a virtual authenticator app or hardware token?

10
Written response
1 point

What is the term for determining which resources an authenticated user may access?

11
Fill in the blank
1 point

MFA requires proof from at least two factor categories. A password plus does not provide two categories.

12
Fill in the blank
1 point

When setting up an authenticator app, scan the displayed and enter the requested to verify setup.

13
Open ended
1 point

An attacker learns an IAM user's password, but the user has MFA enabled and the user's role grants more access than necessary. Explain what MFA may prevent during sign-in, what the user should do about an unexpected MFA prompt, and why the excessive access remains a risk.

14
True or false
1 point

True or false: Enabling MFA for an AWS account’s root user also enables MFA for its IAM users.

  1. A

    True

  2. B

    False

15
Written response
1 point

What does TOTP stand for when describing codes generated by an authenticator app?

16
Choose one
1 point

While enrolling an authenticator, which action best protects the setup secret?

  1. A

    Send the setup secret to a coworker so they can keep a backup.

  2. B

    Keep the setup secret private and do not share it.

  3. C

    Store the setup secret with a shared team password so anyone can retrieve it.

  4. D

    Post the setup secret in a support request to make device registration faster.

17
Choose one
1 point

Which sign-in combination demonstrates MFA by using two different factor categories?

  1. A

    A password and a second password, because they are two separate credentials.

  2. B

    A fingerprint and a face scan, because they are two different biometric checks.

  3. C

    A password and a one-time code from an authenticator app, because they use different factor categories.

  4. D

    Two one-time codes from the same authenticator app, because they are entered separately.

18
Choose one
1 point

Why are passkeys and FIDO security keys preferred when available for AWS sign-in?

  1. A

    They use public-key cryptography to help prevent authentication from being reused on a fake sign-in page.

  2. B

    They turn IAM permissions off whenever a user signs in.

  3. C

    They guarantee that a user’s password cannot be stolen.

  4. D

    They make every sign-in prompt safe to approve.

19
Written response
1 point

After MFA confirms a user’s identity, which AWS mechanisms continue to govern what resources that user may access?

20
Choose one
1 point

An administrator is setting up MFA for a different IAM user in the AWS Management Console. Which navigation path should they use to reach that user’s security credentials?

  1. A

    Choose your own user name, then open Security credentials.

  2. B

    Open IAM Identity Center, select the user, then choose Security credentials.

  3. C

    Choose Users, select the IAM user, then open Security credentials.

  4. D

    Choose the root user, then open Security credentials for the IAM user.