Multi-factor authentication

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does multi-factor authentication (MFA) ask for?

A A second proof of identity as well as your password

B A longer password and nothing else

2. Which one is an example of a second factor?

A Typing your username again

B A code sent to your phone

3. A thief steals your password. You have MFA turned on. What happens when they try to log in?

A They are stopped because they cannot give the second proof

B They get in because the password is correct

4. Which statement about an authenticator app is true?

A It replaces your password so you never need one

B It gives you a code or prompt to confirm it is really you

5. Why is a password plus a phone code safer than a password alone?

A An attacker needs both things to get in

B The phone code makes the password longer

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1SMS code: 482913		Apassword OK, phone code missing = access denied
2Authenticator app prompt: Approve sign-in?		BThe second proof must stay private. Sharing a code lets a scammer get in, so never tell anyone your phone code.
3Multi-factor authentication asks for a second proof of identity in addition to a password		Cpassword + phone code = logged in
4A stolen password is not enough to get into an account that uses multi-factor authentication		DAn app on your device that asks you to approve a login or shows a changing code as a second proof of identity
5Multi-factor login = password + same password again		ETyping the same password twice is not a second factor. The second proof must be different, such as a phone code or an authenticator app approval.
6Share my phone code with a caller to prove it is me		FA one-time code sent to your phone that you enter after your password as a second proof of identity

Definitions

multi-factor authentication

Fill in the Blanks

Complete each line of code by filling in the missing parts.

if passwordOk ___ codeOk:

if codeEntered __ codeSent:

if appApproved == ____:

passwordOk = True codeOk = _____ access = passwordOk and codeOk

if len(proofs) >= _:

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A steps = ["password", "code"]

B needed = len(steps)

C print("Steps:", needed)

D print("One proof is enough")

Question 2

A has_pw = True

B has_code = False

C if has_pw and has_code:

D print("Hacker gets in"

E else:

F print("Hacker is blocked")

Question 3

A code = get_app_code()

B typed = code

C if typed == code:

D print("Verified")

Question 4

A sms_code = "482915"

B entered = input("SMS code: ")

C if entered = sms_code:

D print("Logged in")

E else:

F print("Try again")

Question 5

A password_ok = check_password()

B if not password_ok:

C send_code_to_phone()

D print("Code sent")

Answer Key

Multi-factor authentication

Section A: Quick Questions

A — A second proof of identity as well as your password

B — A code sent to your phone

A — They are stopped because they cannot give the second proof

B — It gives you a code or prompt to confirm it is really you

A — An attacker needs both things to get in

Section B: Match the Pairs

SMS code: 482913 → A one-time code sent to your phone that you enter after your password as a second proof of identity

Authenticator app prompt: Approve sign-in? → An app on your device that asks you to approve a login or shows a changing code as a second proof of identity

Multi-factor authentication asks for a second proof of identity in addition to a password → password + phone code = logged in

A stolen password is not enough to get into an account that uses multi-factor authentication → password OK, phone code missing = access denied

Multi-factor login = password + same password again → Typing the same password twice is not a second factor. The second proof must be different, such as a phone code or an authenticator app approval.

Share my phone code with a caller to prove it is me → The second proof must stay private. Sharing a code lets a scammer get in, so never tell anyone your phone code.

Section C: Definitions

multi-factor authentication — A login step that asks for a second proof of identity, like a phone code or app prompt, as well as your password. A stolen password alone is not enough.

Section D: Fill in the Blanks

if passwordOk and codeOk:

if codeEntered == codeSent:

if appApproved == True:

passwordOk = True
codeOk = False
access = passwordOk and codeOk

if len(proofs) >= 2:

Section E: Spot the Error

D — Multi-factor authentication asks for a second proof as well as the password, so a stolen password alone is not enough. The line should say a second proof is needed, for example print("Need a 2nd proof").

D — The closing bracket is missing, so the print call is not complete. It should be print("Hacker gets in").

B — The student must type the code from the authenticator app. Setting typed = code copies the right answer, so the check would always pass. It should be typed = input("Enter code: ").

C — A single = assigns a value. To compare the typed code with the code sent to the phone, use ==: if entered == sms_code:

B — The phone code is the second step, sent only after the password is correct. With 'not' it would be sent when the password is wrong. It should be if password_ok: