Four accounts use these passwords. Which would take an automated guessing program the longest to break?

Which password is weakest against a guessing attack?

A site allows these passwords. Which is strongest?

Which password is most vulnerable because attackers commonly try it early?

Which password is strongest, even though it contains no symbols such as ! or #?

Four students create passwords from information about themselves. Which choice is hardest to guess from public social-media posts?

Which password is weakest despite being long?

Which password offers the best resistance to an attacker using common words, names, and keyboard patterns?

A password manager suggests these passwords. Which should a student choose for a new account?

Which password is the strongest choice?

Which sign-in sequence uses two genuinely different authentication factors?

A school portal asks for a password and then a fingerprint scan. Are these two different authentication factors?

Which pair is two-factor authentication rather than two knowledge checks?

A banking app requires a password and a face scan. Which statement correctly classifies the checks?

Which sign-in method does NOT provide two different factors?

A user enters a passphrase, then approves a notification on a registered phone. What makes this multi-factor authentication?

Which pair combines a biometric factor with a possession factor?

A website asks a user to enter a password and then answer “What was your first pet's name?” Why is this not true two-factor authentication?

An attacker steals a company's password database and cracks Mia's password. Mia's account also requires a current code from her authenticator app. What does that second factor protect against?

A phishing site captures Lee's password, but Lee's account requires a hardware security key to finish signing in. What cannot the attacker do with the captured password alone?

A student loses a phone that receives sign-in codes. Their password was not revealed. Which risk remains despite two-factor authentication?

An account requires a password and a fingerprint. A thief learns the password from a breach but never accesses the account. What most directly stopped the thief?

A service uses a password plus an authenticator-app code. An attacker installs spyware on a user's unlocked phone and captures both the password and a newly generated code. What is the best conclusion?

A password database is leaked, but passwords were stored as salted hashes. Accounts also use a one-time code from an authenticator app. Which statement is accurate?

A student approves an unexpected sign-in prompt on their phone after entering their password on a fake website. Why can the attacker now get in?

A company requires passwords and text-message codes. An attacker steals only a list of employee passwords. Which claim is supported?

Noah uses “BlueSky!42” for school, gaming, and email. One gaming site has a breach. What change best fixes the main risk?

A student writes passwords on a sticky note attached to an unlocked laptop. Which change directly addresses the weakness?

Rina changes “RiverStone!5” to “RiverStone!6” every month. What is the main problem with this habit?

A student shares a streaming-service password with several friends through a group chat. Which action best reduces the account-security risk?

Kai keeps passwords in a notes app with no screen lock on the phone. Which improvement addresses unauthorized physical access to the stored passwords?

A student uses “SchoolMascot2026!” for a new account because it meets the site's length rule. What is the best replacement?

A family stores every password in a spreadsheet and emails the spreadsheet to each other when it changes. What change best addresses the exposure created by this practice?

A login log shows 400 failed password guesses against one account in two minutes, then a successful login. Which defense would most directly have stopped this brute-force attack?

An account locks after five failures, but an attacker logs in on the first attempt using a password that appears with the user's email in a breach from another website. Which attack fits?

A student receives a message that looks like it is from the school portal and asks them to enter their username, password, and authenticator code at a linked page. The link's domain is not the school's domain. What attack is this?

A company's logs show login attempts using thousands of different usernames and passwords from a previously published breach list; most attempts fail immediately. What attack is occurring?

An attacker tries “password,” “welcome,” “dragon,” and many other words from a large word list against one account. The account owner did not receive any deceptive messages. What attack best fits?

A user enters a password into a fake login page after receiving an urgent email that says their account will be closed today. The attacker uses that password once and logs in successfully. What evidence points most strongly to phishing?

A login system reports thousands of rapid attempts against one username, each using a different generated character combination. There is no evidence of leaked credentials or a fake message. Which attack best fits?