Multi-Factor Authentication quiz

Test your Multi-Factor Authentication knowledge with a free interactive quiz — 25 questions with answers and explanations. No signup needed to play.

Why must a server compare a submitted TOTP code to the expected code using a timing-safe comparison function?

1. Why must a server compare a submitted TOTP code to the expected code using a timing-safe comparison function?
2. Why is MFA consistently ranked as one of the highest-leverage, lowest-cost security controls an organization can deploy?
3. What are passkeys, in relation to the WebAuthn standard?
4. What is a notable limitation of biometric ("something you are") factors compared to the other factor types?
5. What is SIM swapping, and how does it undermine SMS-based MFA?
6. Where does a WebAuthn/passkey private key reside during authentication?
7. Which of these is an example of a "something you know" authentication factor?
8. A user has a password and a memorized PIN as their two login requirements. Does this qualify as true MFA?
9. Why is SMS OTP also considered phishable in a way WebAuthn is not?
10. How does HOTP differ from TOTP in what drives the code generation?
11. What is the core idea behind adaptive (risk-based) authentication?
12. A password plus a time-based code generated by an authenticator app on the user's phone is an example of combining which two factor categories?

More quizzes