Cybersecurity Awareness for Employees Course：Passwords, passphrases and multi-factor authentication

1. 第1题，共16题

   What does the Cyber Centre recommend for a passphrase?

   • AAt least 3 words and 10 characters, with one number
   • BAt least 4 words and 15 characters
   • COne long word with no spaces
   • DAt least 2 words and 8 characters, with one capital letter
   显示答案

   答案: B. At least 4 words and 15 characters

   The Cyber Centre recommends passphrases of at least 4 words and 15 characters.

2. 第2题，共16题

   If you cannot use a passphrase, how long should a password be, according to the Cyber Centre?

   • AAt least 6 characters
   • BAt least 10 characters
   • CAt least 12 characters
   • DAt least 8 characters
   显示答案

   答案: C. At least 12 characters

   The Cyber Centre and Get Cyber Safe both say to use a password of at least 12 characters, mixing letters, numbers and symbols.

3. 第3题，共16题

   Which of these best follows the passphrase advice?

   • ASummer2024!
   • BRex2015
   • Ccopper lantern drifts west
   • Dpassword1234
   显示答案

   答案: C. copper lantern drifts west

   "copper lantern drifts west" has 4 random words and 26 characters. The others are short or easy to guess.

4. 第4题，共16题

   Which password idea does Get Cyber Safe warn against?

   • AUsing your pet's name or a family member's birthday
   • BUsing four or more random words together
   • CUsing the first letters of a sentence you remember
   • DUsing a different password for each account
   显示答案

   答案: A. Using your pet's name or a family member's birthday

   Easy-to-guess personal details, like a pet's name or a family birthday, are weak. The other three are ideas Get Cyber Safe recommends.

5. 第5题，共16题

   Why should you use a different password for every account?

   • ASo you can share passwords with your coworkers more easily
   • BBecause websites block any password that is used on another site
   • CSo your password manager does not get too full
   • DSo one stolen password cannot open your other accounts
   显示答案

   答案: D. So one stolen password cannot open your other accounts

   If you reuse a password and one account is breached, criminals may be able to access your other accounts too.

6. 第6题，共16题

   What is multi-factor authentication (MFA)?

   • AChanging your password every day so no one can guess it
   • BLetting a trusted coworker sign in for you
   • CUsing the same strong password on several different devices
   • DSigning in with two or more kinds of proof
   显示答案

   答案: D. Signing in with two or more kinds of proof

   MFA needs two or more different authentication factors, so a stolen password alone is not enough to get in.

7. 第7题，共16题

   In MFA, a fingerprint is which kind of factor?

   • ASomething you share
   • BSomething you know
   • CSomething you have
   • DSomething you are
   显示答案

   答案: D. Something you are

   Biometrics such as fingerprints, faces or voices are "something you are".

8. 第8题，共16题

   In MFA, a security key or your phone is which kind of factor?

   • ASomething you write down
   • BSomething you have
   • CSomething you know
   • DSomething you are
   显示答案

   答案: B. Something you have

   Hard tokens such as USB keys or access cards, and soft tokens such as authenticator apps, are "something you have".

9. 第9题，共16题

   Which sign-in uses two DIFFERENT kinds of factors?

   • ATwo different passwords, typed one after the other
   • BA password plus an authenticator app code
   • CA password plus an answer to a security question
   • DA short PIN followed by a second, longer PIN
   显示答案

   答案: B. A password plus an authenticator app code

   A password is something you know and the app on your phone is something you have. The other options use two things you know.

10. 第10题，共16题

    What does a password manager do?

    • AStores your passwords in a protected vault
    • BRemoves the need for any passwords on your accounts at all
    • CChanges your password at every sign-in
    • DSends a copy of all your passwords to your IT team each week
    显示答案

    答案: A. Stores your passwords in a protected vault

    A password manager is a vault that stores usernames and passwords, so you can use unique, complex passwords without memorizing each one.

11. 第11题，共16题

    How should you protect a password manager?

    • ATurn off its security alerts so it does not slow you down
    • BA strong master passphrase plus MFA
    • CWrite the master password on a sticky note beside your screen
    • DUse the same master password as your work email account
    显示答案

    答案: B. A strong master passphrase plus MFA

    The master password unlocks every account in the vault, so protect it well and turn on MFA.

12. 第12题，共16题

    What does Get Cyber Safe advise for your most sensitive passwords, such as email and banking?

    • AMemorize them; don't store them in the manager
    • BStore them in a note on your phone so they are always with you
    • CUse the same password for both so they are easier to remember
    • DShare them with one trusted coworker
    显示答案

    答案: A. Memorize them; don't store them in the manager

    Get Cyber Safe says accounts such as email and banking should not be stored in a password manager; memorize those passwords instead.

13. 第13题，共16题

    A coworker covering your shift asks for your login to check a schedule. What should you do?

    • ATell them your password, but only for this one shift
    • BKeep it private; ask a supervisor or IT for access
    • CWrite it down for them and take the paper back after the shift
    • DText it to them now and change it next month
    显示答案

    答案: B. Keep it private; ask a supervisor or IT for access

    Never share your passwords. Access should come through the person's own account.

14. 第14题，共16题

    Read the situation. What does this pattern most likely mean?

    It is 11 p.m. and you are at home watching TV. Your phone shows six sign-in approval requests for your work account in two minutes. You are not trying to sign in to anything.

    • AYour account was locked because of the late hour
    • BThe IT team is testing every account in the company at night
    • CYour phone needs a software update before it can work properly
    • DSomeone has your password and wants your approval
    显示答案

    答案: D. Someone has your password and wants your approval

    Repeated approval prompts you did not start are an "MFA fatigue" attack: the attacker keeps asking until the target gives in.

15. 第15题，共16题

    Read the situation. What should you do?

    It is 11 p.m. and you are at home watching TV. Your phone shows six sign-in approval requests for your work account in two minutes. You are not trying to sign in to anything.

    • AIgnore the requests and do not mention them to anyone
    • BTurn off MFA on your work account for the rest of the night
    • CApprove one of the requests so the alerts finally stop
    • DDeny them, report it to IT right away and change your password
    显示答案

    答案: D. Deny them, report it to IT right away and change your password

    Never approve a sign-in you did not start. Notify your IT or security team, change your password and reset MFA as they direct.

16. 第16题，共16题

    Some MFA systems ask you to type a number shown on the sign-in screen. What attack does this "number matching" help prevent?

    • ADirectory scams
    • BMFA fatigue
    • CShoulder surfing
    • DTyposquatting
    显示答案

    答案: B. MFA fatigue

    Number matching makes you enter a number shown on the sign-in screen. The Cyber Centre says it helps protect against MFA fatigue attacks.

键盘：按1–4作答，按 Enter 进入下一题。