Password & Authentication Best Practices Quiz

1. What is the purpose of a salt in password hashing?

To speed up the hashing process

To make identical passwords produce different hashes

To reduce storage space

To encrypt the password before hashing

2. An organization implements Password & Authentication Best Practices by requiring MFA, enforcing strong password policies, using secure hashing, and monitoring for compromised credentials. Which element is MOST critical for immediate threat mitigation?

Requiring 20-character passwords

Detecting and revoking compromised credentials

Changing password expiration to 30 days

Disabling all legacy authentication methods

3. What does FIDO2 authentication provide that traditional passwords do not?

Phishing-resistant cryptographic verification

Faster typing speed

Longer character limits

Automatic password updates

4. True or False: HTTPS encryption makes passwords visible to network administrators on the same network.

True

False

5. Which of the following is a security risk when implementing password policies?

Requiring very frequent password changes may cause users to write them down

Complexity requirements always prevent unauthorized access

Longer passwords are never necessary

MFA eliminates all password vulnerabilities

Submit

7. What is the primary advantage of using a password manager for organizational security?

It eliminates the need for strong passwords

It centralizes credential storage and enables secure sharing

It prevents all cyberattacks

It removes the need for MFA

8. True or False: Biometric authentication (fingerprint, facial recognition) is completely immune to spoofing attacks.

True

False

9. Which of the following best describes zero-trust authentication architecture?

Never requiring authentication after initial login

Verifying every access request regardless of network location

Trusting only users on the corporate network

Eliminating the need for passwords entirely

Submit

11. What is the primary benefit of multi-factor authentication (MFA) in modern security?

It eliminates the need for strong passwords

It requires an attacker to compromise multiple authentication factors

It reduces server processing time

It prevents all types of phishing attacks

12. Which attack type involves tricking users into revealing credentials by impersonating a trusted entity?

Dictionary attack

Brute force attack

Phishing

Rainbow table attack

13. True or False: Session tokens should be stored in browser local storage for optimal security.

True

False

Submit

15. Which authentication protocol is most secure for modern web applications?

HTTP Basic Authentication

OAuth 2.0 with HTTPS

Telnet with passwords

FTP with plain text login

16. What does the OWASP Top 10 recommend regarding password expiration policies?

Passwords must expire every 30 days

Only expire passwords when there is evidence of compromise

Passwords should never expire

Passwords must expire every 6 months without exception

17. Which of the following is NOT a recommended password policy practice?

Requiring periodic password changes every 90 days

Enforcing complexity requirements (uppercase, numbers, symbols)

Preventing password reuse from history

Allowing users to write passwords on sticky notes

18. True or False: Storing passwords in plain text in a database is acceptable if the database is encrypted.

True

False

Submit

20. Which password hashing algorithm is considered industry standard for new implementations?

MD5

SHA-1

Bcrypt or Argon2

ROT13

Password Quiz: Can You Build Unbreakable Auth?

1. What is the purpose of a salt in password hashing?

2.

What first name or nickname would you like us to use?

2. An organization implements Password & Authentication Best Practices by requiring MFA, enforcing strong password policies, using secure hashing, and monitoring for compromised credentials. Which element is MOST critical for immediate threat mitigation?

3. What does FIDO2 authentication provide that traditional passwords do not?

4. True or False: HTTPS encryption makes passwords visible to network administrators on the same network.

5. Which of the following is a security risk when implementing password policies?

6. A ____ is a pre-computed table of password hashes used to crack passwords quickly.

7. What is the primary advantage of using a password manager for organizational security?

8. True or False: Biometric authentication (fingerprint, facial recognition) is completely immune to spoofing attacks.

9. Which of the following best describes zero-trust authentication architecture?

10. A ____ attack systematically tries every possible password combination until access is gained.

11. What is the primary benefit of multi-factor authentication (MFA) in modern security?

12. Which attack type involves tricking users into revealing credentials by impersonating a trusted entity?

13. True or False: Session tokens should be stored in browser local storage for optimal security.

14. A ____ is a temporary string of characters sent to a user's registered device to verify identity.

15. Which authentication protocol is most secure for modern web applications?

16. What does the OWASP Top 10 recommend regarding password expiration policies?

17. Which of the following is NOT a recommended password policy practice?

18. True or False: Storing passwords in plain text in a database is acceptable if the database is encrypted.

19. A user's password should be at least ____ characters long for strong security.

20. Which password hashing algorithm is considered industry standard for new implementations?