Cybersecurity Awareness for Employees Course: Passwords, passphrases and multi-factor authentication

1. Question 1 of 16

   What does the Cyber Centre recommend for a passphrase?

   • AAt least 3 words and 10 characters, with one number
   • BAt least 4 words and 15 characters
   • COne long word with no spaces
   • DAt least 2 words and 8 characters, with one capital letter
   Show answer

   Answer: B. At least 4 words and 15 characters

   The Cyber Centre recommends passphrases of at least 4 words and 15 characters.

2. Question 2 of 16

   If you cannot use a passphrase, how long should a password be, according to the Cyber Centre?

   • AAt least 6 characters
   • BAt least 10 characters
   • CAt least 12 characters
   • DAt least 8 characters
   Show answer

   Answer: C. At least 12 characters

   The Cyber Centre and Get Cyber Safe both say to use a password of at least 12 characters, mixing letters, numbers and symbols.

3. Question 3 of 16

   Which of these best follows the passphrase advice?

   • ASummer2024!
   • BRex2015
   • Ccopper lantern drifts west
   • Dpassword1234
   Show answer

   Answer: C. copper lantern drifts west

   "copper lantern drifts west" has 4 random words and 26 characters. The others are short or easy to guess.

4. Question 4 of 16

   Which password idea does Get Cyber Safe warn against?

   • AUsing your pet's name or a family member's birthday
   • BUsing four or more random words together
   • CUsing the first letters of a sentence you remember
   • DUsing a different password for each account
   Show answer

   Answer: A. Using your pet's name or a family member's birthday

   Easy-to-guess personal details, like a pet's name or a family birthday, are weak. The other three are ideas Get Cyber Safe recommends.

5. Question 5 of 16

   Why should you use a different password for every account?

   • ASo you can share passwords with your coworkers more easily
   • BBecause websites block any password that is used on another site
   • CSo your password manager does not get too full
   • DSo one stolen password cannot open your other accounts
   Show answer

   Answer: D. So one stolen password cannot open your other accounts

   If you reuse a password and one account is breached, criminals may be able to access your other accounts too.

6. Question 6 of 16

   What is multi-factor authentication (MFA)?

   • AChanging your password every day so no one can guess it
   • BLetting a trusted coworker sign in for you
   • CUsing the same strong password on several different devices
   • DSigning in with two or more kinds of proof
   Show answer

   Answer: D. Signing in with two or more kinds of proof

   MFA needs two or more different authentication factors, so a stolen password alone is not enough to get in.

7. Question 7 of 16

   In MFA, a fingerprint is which kind of factor?

   • ASomething you share
   • BSomething you know
   • CSomething you have
   • DSomething you are
   Show answer

   Answer: D. Something you are

   Biometrics such as fingerprints, faces or voices are "something you are".

8. Question 8 of 16

   In MFA, a security key or your phone is which kind of factor?

   • ASomething you write down
   • BSomething you have
   • CSomething you know
   • DSomething you are
   Show answer

   Answer: B. Something you have

   Hard tokens such as USB keys or access cards, and soft tokens such as authenticator apps, are "something you have".

9. Question 9 of 16

   Which sign-in uses two DIFFERENT kinds of factors?

   • ATwo different passwords, typed one after the other
   • BA password plus an authenticator app code
   • CA password plus an answer to a security question
   • DA short PIN followed by a second, longer PIN
   Show answer

   Answer: B. A password plus an authenticator app code

   A password is something you know and the app on your phone is something you have. The other options use two things you know.

10. Question 10 of 16

    What does a password manager do?

    • AStores your passwords in a protected vault
    • BRemoves the need for any passwords on your accounts at all
    • CChanges your password at every sign-in
    • DSends a copy of all your passwords to your IT team each week
    Show answer

    Answer: A. Stores your passwords in a protected vault

    A password manager is a vault that stores usernames and passwords, so you can use unique, complex passwords without memorizing each one.

11. Question 11 of 16

    How should you protect a password manager?

    • ATurn off its security alerts so it does not slow you down
    • BA strong master passphrase plus MFA
    • CWrite the master password on a sticky note beside your screen
    • DUse the same master password as your work email account
    Show answer

    Answer: B. A strong master passphrase plus MFA

    The master password unlocks every account in the vault, so protect it well and turn on MFA.

12. Question 12 of 16

    What does Get Cyber Safe advise for your most sensitive passwords, such as email and banking?

    • AMemorize them; don't store them in the manager
    • BStore them in a note on your phone so they are always with you
    • CUse the same password for both so they are easier to remember
    • DShare them with one trusted coworker
    Show answer

    Answer: A. Memorize them; don't store them in the manager

    Get Cyber Safe says accounts such as email and banking should not be stored in a password manager; memorize those passwords instead.

13. Question 13 of 16

    A coworker covering your shift asks for your login to check a schedule. What should you do?

    • ATell them your password, but only for this one shift
    • BKeep it private; ask a supervisor or IT for access
    • CWrite it down for them and take the paper back after the shift
    • DText it to them now and change it next month
    Show answer

    Answer: B. Keep it private; ask a supervisor or IT for access

    Never share your passwords. Access should come through the person's own account.

14. Question 14 of 16

    Read the situation. What does this pattern most likely mean?

    It is 11 p.m. and you are at home watching TV. Your phone shows six sign-in approval requests for your work account in two minutes. You are not trying to sign in to anything.

    • AYour account was locked because of the late hour
    • BThe IT team is testing every account in the company at night
    • CYour phone needs a software update before it can work properly
    • DSomeone has your password and wants your approval
    Show answer

    Answer: D. Someone has your password and wants your approval

    Repeated approval prompts you did not start are an "MFA fatigue" attack: the attacker keeps asking until the target gives in.

15. Question 15 of 16

    Read the situation. What should you do?

    It is 11 p.m. and you are at home watching TV. Your phone shows six sign-in approval requests for your work account in two minutes. You are not trying to sign in to anything.

    • AIgnore the requests and do not mention them to anyone
    • BTurn off MFA on your work account for the rest of the night
    • CApprove one of the requests so the alerts finally stop
    • DDeny them, report it to IT right away and change your password
    Show answer

    Answer: D. Deny them, report it to IT right away and change your password

    Never approve a sign-in you did not start. Notify your IT or security team, change your password and reset MFA as they direct.

16. Question 16 of 16

    Some MFA systems ask you to type a number shown on the sign-in screen. What attack does this "number matching" help prevent?

    • ADirectory scams
    • BMFA fatigue
    • CShoulder surfing
    • DTyposquatting
    Show answer

    Answer: B. MFA fatigue

    Number matching makes you enter a number shown on the sign-in screen. The Cyber Centre says it helps protect against MFA fatigue attacks.

Keyboard: 1–4 to answer, Enter for the next question.