← VCE Cyber Security

Multi-factor authentication

A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

Part of: VCE Applied Computing - U2O2 - Cyber Security — Module 37, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 41, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 29, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 39, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 107, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 72, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 49, WA Computer Science ATAR Year 11 — Network Communications — Module 125, WA Computer Science ATAR Year 11 — Cyber Security — Module 104

Understanding Multi-factor authentication in VCE Cyber Security

What it does: This code verifies the entered one-time code as the required second factor. MFA requires at least one additional factor beyond the password, such as an OTP or biometric. Adding a second factor makes it much harder for an attacker to gain access with a stolen password alone. It's something you have (your phone), a common second authentication factor. Biometrics like fingerprints are classified as 'something you are'. Disabling MFA removes the extra layer of protection, making the account easier to compromise. Security questions are often guessable or discoverable, making OTPs a stronger second factor. This condition checks that both the password and OTP are correct before granting access.

Common mistakes: Line 1 disables MFA (require_mfa = False), skipping the second authentication factor entirely. Line 2 sets skip_otp to True, bypassing the required one-time code check.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Multi-factor authentication to a class →

This module's key terms are also in a printable crossword (Modules 31–40) and word search (Modules 21–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Multi-factor authentication requires only a password to log in.
TrueFalse
Matches
skip_otp = True
↓
The mistake: bypassing the OTP check, disabling MFA
Applying
Meanings
Term
Multi-factor authentication
Meaning
A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.
Practice
password_correct = True
Testing
Gaps
= getotpcode()
Check Answer
Spots
1require_mfa = False
2verify_password()

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Silverback Gorilla' badge — Savannah Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Multi-factor authentication requires only a password to log in.
A. False ✓
B. True
MFA requires at least one additional factor beyond the password, such as an OTP or biometric.
2. Which is more secure: a password alone, or a password plus a one-time code?
A. Password alone
B. Password plus one-time code ✓
Adding a second factor makes it much harder for an attacker to gain access with a stolen password alone.
3. A one-time code sent to your phone is an example of an MFA factor.
A. True ✓
B. False
It's something you have (your phone), a common second authentication factor.
4. Which factor type is a fingerprint scan?
A. Something you know
B. Something you are ✓
Biometrics like fingerprints are classified as 'something you are'.
5. Disabling MFA makes an account harder to compromise.
A. False ✓
B. True
Disabling MFA removes the extra layer of protection, making the account easier to compromise.

Match the Pairs

otp = generate_otp() → Generating a one-time code for the second factor
if password_ok and otp_ok: → Granting access only when both factors are verified
MFA adds a second verification step beyond the password → verify_otp(code, otp_correct)
A code sent to a trusted device is a common MFA factor → send_otp(user, otp)
skip_otp = True → The mistake: bypassing the OTP check, disabling MFA
otp = "000000" → The mistake: using a fixed, predictable one-time code

Key Term

Multi-factor authentication
A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

Fill in the Blanks

1. otp = get_otp_code()
Hint: Type the name of the variable that stores the one-time code.
2. if passwordOk and otpOk:
Hint: Type the logical operator that requires both conditions to be true.
3. verify_otp(code, otp_correct)
Hint: Type the name of the function that checks the entered one-time code.
4. mfa_enabled = True
Hint: Type the name of the variable that flags whether MFA is turned on.
5. authenticate(password, otp)
Hint: Type the name of the second argument representing the one-time code factor.

Spot the Error

Question 1
A require_mfa = False
B verify_password()
C verify_otp()
Line A — Line 1 disables MFA (require_mfa = False), skipping the second authentication factor entirely.
Question 2
A verify_password()
B skip_otp = True
C verify_otp()
Line B — Line 2 sets skip_otp to True, bypassing the required one-time code check.
Question 3
A login_ok = check_password()
B otp_ok = True
C grant_access()
Line B — Line 2 hardcodes otp_ok to True instead of actually verifying the entered code.
Question 4
A password_ok = login()
B otp_code = get_otp()
C if password_ok:
D grant_access()
E skip_otp_check = True
Line E — Line 5 sets skip_otp_check to True, allowing access without verifying the OTP.
Question 5
A otp = generate_otp()
B send_otp(user, otp)
C otp = "000000"
Line C — Line 3 overwrites the randomly generated OTP with a fixed, guessable value.

Student with a class code? Join your class →