TRB PG Assistant - Password Management - secure password guidelines, two-step verification, password managers One Line Questions & Answers

1. What is a 'master password' in the context of a password manager? — A unique, strong password that unlocks the password manager's encrypted vault.

2. What is a 'rainbow table' in password cracking? — A pre-computed table of password hashes that attackers use to quickly find the original password.

3. What is a security question, and what are its limitations? — A question used for account recovery; can be vulnerable if the answers are easily guessable or publicly known.

4. Besides SMS codes, what is another common method for the second factor in MFA? — Biometric authentication (e.g., fingerprint, face scan).

5. What is a 'session cookie' in relation to password security? — A small piece of data stored by the browser that maintains a user's logged-in state for a session, which can be a risk if not managed securely.

6. What is a password manager? — A tool that automatically generates and stores strong, unique passwords for different websites.

7. What is a 'keylogger' and how can it compromise password security? — A type of malicious software that records keystrokes, potentially capturing passwords as they are typed.

8. What is a 'salt' in password security? — A unique, random string added to a password before hashing to make pre-computed rainbow table attacks ineffective.

9. What does 'dictionary attack' mean in the context of password cracking? — An attack that tries common words and phrases from a dictionary to guess a password.

10. What is a 'brute-force attack' in relation to passwords? — An attack where an attacker tries every possible combination of characters to guess a password.

11. What is a 'phishing' attack, and how does it relate to password security? — An attack where attackers try to trick users into revealing their passwords through deceptive emails or websites.

12. What is a 'credential stuffing' attack? — An attack where attackers use lists of stolen username-password combinations from one breach to try and log into other unrelated services.

13. What is a common recommendation for password length to enhance security? — At least 12 characters.

14. When implementing Two-Step Verification, which method is generally considered more secure than SMS codes? — Authenticator apps or hardware security keys.

15. What is the role of a password manager in preventing credential stuffing attacks? — By ensuring each account has a unique password, so a breach in one site doesn't compromise others.

16. How do most password managers protect the stored passwords? — By encrypting the password database with a single master password.

17. If a website offers Two-Step Verification, what should you do? — Enable it immediately to add an extra layer of security.

18. Which of the following is a characteristic of a secure password manager? — End-to-end encryption and a strong master password requirement.

19. What is a potential security risk of reusing the same password across multiple online accounts? — If one account is compromised, all other accounts using the same password become vulnerable.

20. What is a potential risk associated with using a password manager that is not password-protected itself? — If the device is lost or stolen, all stored passwords could be accessed.

21. What is the main advantage of using a password manager for generating passwords? — It can create extremely long and complex passwords that are difficult for humans to remember but strong against attacks.

22. What is a primary benefit of using a password manager? — It eliminates the need to remember any passwords.

23. What is the main security benefit of using a password manager's auto-fill feature? — It prevents keyloggers from capturing your password by bypassing direct typing.

24. What is a 'social engineering' attack related to passwords? — Manipulating individuals into divulging confidential information like passwords.

25. Which of the following is an example of a strong password? — Tr3@$ur3_M@p_7!

26. Which character set should ideally be included in a strong password? — Uppercase letters, lowercase letters, numbers, and special symbols.

27. Why is it advised NOT to save your password in your web browser if you are using a public or shared computer? — Other users of the computer could easily access your saved passwords.

28. What is a common recommendation for how often to change your password? — Periodically (e.g., every 90 days) or immediately if compromised.

29. What is the principle behind 'password aging'? — Requiring users to change their passwords periodically to reduce the risk of compromise.

30. What is a 'rainbow table attack' mitigated by? — Salting passwords before hashing.

31. Which of the following is NOT a characteristic of a strong password? — Short length (e.g., 4-6 characters).

32. When using Two-Step Verification, what should you do with backup codes? — Store them in a secure, offline location, separate from your primary device.

33. Which of the following is a common second factor in Two-Step Verification? — A code sent to a registered mobile device via SMS.

34. Why is using a password like '123456' or 'qwerty' considered extremely weak? — These are common patterns and are among the first combinations tried in brute-force and dictionary attacks.

35. Why should you avoid typing your password on public or untrusted Wi-Fi networks? — These networks are often unencrypted, allowing attackers to intercept your login credentials.

36. Why is it recommended to avoid using personal information like birthdays or pet names in passwords? — This information is often publicly available and can be guessed by attackers.

37. What is the purpose of Two-Step Verification (2SV) or Multi-Factor Authentication (MFA)? — To add an extra layer of security by requiring more than just a password.

38. What is the primary function of a password hashing algorithm? — To convert a password into a fixed-size string of characters (hash) that cannot be easily reversed back to the original password.

39. What is the primary goal of implementing Two-Step Verification? — To ensure that even if a password is stolen, the account remains protected.

40. What is the primary purpose of a strong password? — To make it difficult for unauthorized users to access an account.

41. Why is it important to change passwords immediately if you suspect an account has been compromised? — To prevent the attacker from gaining further access or misusing the account.

42. Why is it important to log out of accounts when using a shared or public computer? — To prevent the next user from accessing your account or sensitive information.

43. What is the purpose of the 'password strength meter' often found on websites? — To provide real-time feedback on how secure the chosen password is.

44. When setting up a new account, what is the best approach for creating a password? — Use the password manager's built-in generator to create a strong, unique password.

45. Which of the following password practices is LEAST secure? — Using 'Password123!' for your bank account.

46. Which of the following is a weak password strategy? — Using common words or phrases like 'password' or '123456'.

47. What is the most secure method for managing a large number of complex passwords? — Using a reputable password manager with a strong master password and MFA.

48. Which of these is a common security practice for password managers? — Enabling two-factor authentication for the password manager account itself.

49. Which of the following is a recommended method for securely storing passwords if you are not using a password manager? — Memorizing a unique, complex password for each important account.

Password Management - secure password guidelines, two-step verification, password managers - One Line Questions