AP Cybersecurity
AP Cybersecurity / All lessons / Unit 4: Securing Devices
4Unit 4: Securing Devices
AP Cybersecurity topic 4.2

Authentication

Authentication proves who you are. Factors are something you know (password), something you have (phone or security key), and something you are (fingerprint). Multifactor authentication (MFA) combines different factors. Long passphrases resist brute-force attacks, and passwords should be stored as salted hashes, never as plain text.

Authentication vocabulary

  • MFA: Multifactor authentication: using two or more different kinds of factors.
  • Brute force: Trying every possible password until one works.
  • Hash: A one-way fingerprint of data used to check passwords without storing them.
  • Password manager: An app that creates and stores unique strong passwords.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Analyze Risk

1. Which of the following best explains why systems store a hash of a password instead of the password itself?

  1. (A) Hashes take up more storage, which slows attackers down
  2. (B) If the database is stolen, adversaries do not immediately see the actual passwords
  3. (C) Hashes can be easily reversed by the administrator
  4. (D) Hashes let users log in without a password
Show answer

(B) If the database is stolen, adversaries do not immediately see the actual passwords Hashing is one-way, so a stolen hash database does not directly reveal passwords.

Skill: Detect Attacks 
users.db (stolen)
username  password_hash
anguyen   5f4dcc3b5aa7
bwells    5f4dcc3b5aa7
cortiz    e99a18c428cb

2. Which of the following can an adversary conclude from this stolen file?

  1. (A) anguyen and bwells have the same password
  2. (B) cortiz has the strongest password
  3. (C) All three users are administrators
  4. (D) The passwords are stored in plaintext
Show answer

(A) anguyen and bwells have the same password Identical unsalted hashes mean identical passwords. Salting would make the hashes differ.

Skill: Mitigate Risk

3. An administrator wants to stop online brute-force attacks against staff accounts. Which login setting would be most effective?

  1. (A) Lock the account for 15 minutes after 5 failed attempts
  2. (B) Allow unlimited attempts
  3. (C) Show the password hint after one failed attempt
  4. (D) Disable passwords entirely
Show answer

(A) Lock the account for 15 minutes after 5 failed attempts An account lockout policy makes online guessing impractical.

Skill: Analyze Risk

4. A user logs in with a password and then taps "Approve" on a notification sent to their phone. Which authentication factors are used?

  1. (A) Knowledge and possession
  2. (B) Knowledge and biometric
  3. (C) Possession and location
  4. (D) Biometric and location
Show answer

(A) Knowledge and possession The password is something you know, and the phone is something you have.

Open 4.2 in the interactive course