• (A) Yes — two inputs are required, so it is by definition two-factor.
• (B) No — both inputs are “something you know,” so this is single-factor authentication with two steps.
• (C) Yes — security questions are considered “something you are” because they reflect personal history.
• (D) No — passwords can never be part of MFA; they must be replaced entirely.

• (A) DAC — the user’s department owns the resource.
• (B) MAC — department is acting as a clearance label.
• (C) RBAC — “Finance” is a role.
• (D) ABAC — access is evaluated against multiple attributes of user, device, time, and location.

INTERNAL MEMO: Account Policy Update
To: All Department Managers
From: IT Admin (new hire)

1. All new hires will receive a Standard User account on Day 1.
2. Managers with a business need may request elevated privileges.
3. To simplify troubleshooting, ALL support technicians will be
   granted Domain Admin rights indefinitely.
4. Privileged accounts will be audited quarterly.

• (A) Line 1 — Day-1 accounts should be Administrator-level for productivity.
• (B) Line 2 — managers should never be involved in access requests.
• (C) Line 3 — granting Domain Admin to an entire team “indefinitely” violates the principle of least privilege and creates an enormous blast radius if any one of those accounts is compromised.
• (D) Line 4 — privileged accounts should never be audited; that reveals the audit criteria to attackers.

• I. FIDO2 hardware security keys are considered phishing-resistant because they cryptographically bind the login to the real origin.
• II. SMS-based MFA is vulnerable to SIM-swapping, which is why regulators increasingly discourage it for high-value accounts.
• III. Passkeys remove the shared-secret problem because there is no password stored on the server that an attacker could steal in a breach.
• IV. Push-based MFA is inherently phishing-resistant because the approval happens on a separate device.

1. The rule that every user and service should have ONLY the minimum access required to do their job is called the principle of .

2. When an attacker convinces a mobile carrier to transfer a victim’s phone number to a new SIM in order to steal SMS codes, the attack is called a .

3. The rule that no single person should be able to complete a sensitive end-to-end workflow alone is called .