TRB PG Assistant - Password Management - secure password guidelines, two-step verification, password managers Online Test (MCQ Quiz)

1. What is the primary purpose of a strong password?

A) To make it difficult for unauthorized users to access an account. B) To simplify the login process for legitimate users. C) To increase the speed of network connections. D) To reduce the amount of data stored on a server.

2. Which of the following is NOT a characteristic of a strong password?

A) Short length (e.g., 4-6 characters). B) Inclusion of a mix of uppercase and lowercase letters. C) Use of numbers and special characters. D) Avoidance of easily guessable personal information.

3. Why is it recommended to avoid using personal information like birthdays or pet names in passwords?

A) This information is often publicly available and can be guessed by attackers. B) Personal information slows down the authentication process. C) It violates privacy regulations for password creation. D) Operating systems automatically flag such passwords as insecure.

4. What is a common recommendation for password length to enhance security?

A) At least 8 characters. B) At least 12 characters. C) Exactly 10 characters. D) No more than 6 characters.

5. Which character set should ideally be included in a strong password?

A) Only lowercase letters. B) Uppercase letters, lowercase letters, numbers, and special symbols. C) Only numbers. D) Only special symbols.

6. What is a potential security risk of reusing the same password across multiple online accounts?

A) If one account is compromised, all other accounts using the same password become vulnerable. B) It increases the likelihood of forgetting the password. C) It violates terms of service for most websites. D) It slows down the overall system performance.

7. What is the purpose of Two-Step Verification (2SV) or Multi-Factor Authentication (MFA)?

A) To add an extra layer of security by requiring more than just a password. B) To automate password changes at regular intervals. C) To encrypt all user data stored on the device. D) To verify the user's physical location for access.

8. Which of the following is a common second factor in Two-Step Verification?

A) The user's username. B) A code sent to a registered mobile device via SMS. C) The user's email address. D) The date of birth.

9. Besides SMS codes, what is another common method for the second factor in MFA?

A) A security question. B) Biometric authentication (e.g., fingerprint, face scan). C) The user's IP address. D) The time of day.

10. What is a password manager?

A) A tool that automatically generates and stores strong, unique passwords for different websites. B) A program that forces users to change their passwords weekly. C) A service that monitors websites for data breaches. D) An application that blocks suspicious login attempts.

11. What is a primary benefit of using a password manager?

A) It eliminates the need to remember any passwords. B) It allows users to create very short and simple passwords. C) It automatically logs users into websites without any interaction. D) It encrypts all internet traffic.

12. How do most password managers protect the stored passwords?

A) By storing them in plain text on the user's device. B) By encrypting the password database with a single master password. C) By sharing passwords among all users of the service. D) By using weak, easily crackable encryption methods.

13. What is a 'master password' in the context of a password manager?

A) A password that is used for all accounts managed by the tool. B) A unique, strong password that unlocks the password manager's encrypted vault. C) A default password provided by the password manager software. D) A password that grants administrative access to the password manager service.

14. Which of these is a common security practice for password managers?

A) Using a weak master password for easy recall. B) Sharing the master password with family members. C) Enabling two-factor authentication for the password manager account itself. D) Storing the master password in a plain text file.

15. What is a 'phishing' attack, and how does it relate to password security?

A) An attack where attackers try to trick users into revealing their passwords through deceptive emails or websites. B) An attack that floods a server with traffic to make it unavailable. C) An attack that exploits vulnerabilities in software to gain unauthorized access. D) An attack that scrambles data so it cannot be read without a key.

16. Why should you avoid typing your password on public or untrusted Wi-Fi networks?

A) These networks are often unencrypted, allowing attackers to intercept your login credentials. B) Public Wi-Fi automatically logs your password for future use. C) It can cause network congestion. D) It violates the terms of service of the Wi-Fi provider.

17. What is a 'brute-force attack' in relation to passwords?

A) An attack where an attacker tries every possible combination of characters to guess a password. B) An attack that uses social engineering to obtain a password. C) An attack that exploits a known vulnerability in a password hashing algorithm. D) An attack that targets weak passwords by looking them up in a dictionary.

18. Which of the following is a recommended method for securely storing passwords if you are not using a password manager?

A) Writing them down on a sticky note attached to your monitor. B) Storing them in a document named 'Passwords.txt' on your desktop. C) Memorizing a unique, complex password for each important account. D) Using the same simple password for all accounts.

19. What does 'dictionary attack' mean in the context of password cracking?

A) An attack that tries common words and phrases from a dictionary to guess a password. B) An attack that uses a list of known compromised passwords. C) An attack that targets passwords containing only dictionary words. D) An attack that involves social engineering by asking for the password.

20. What is a 'salt' in password security?

A) A unique, random string added to a password before hashing to make pre-computed rainbow table attacks ineffective. B) A type of encryption algorithm used for passwords. C) A method for users to reset their forgotten passwords. D) A security feature that locks an account after multiple failed login attempts.

21. Why is it important to change passwords immediately if you suspect an account has been compromised?

A) To prevent the attacker from gaining further access or misusing the account. B) To reset the password to a default setting. C) To trigger a security audit on the account. D) To comply with website terms of service.

22. What is a 'rainbow table' in password cracking?

A) A pre-computed table of password hashes that attackers use to quickly find the original password. B) A list of common password patterns used in dictionary attacks. C) A database of compromised user credentials. D) A technique for generating strong, random passwords.

23. Which of the following password practices is LEAST secure?

A) Using 'Password123!' for your bank account. B) Using a unique 14-character password with mixed cases, numbers, and symbols for your email. C) Enabling two-factor authentication on your social media accounts. D) Using a password manager to store your credentials.

24. What is a security question, and what are its limitations?

A) A question used for account recovery; can be vulnerable if the answers are easily guessable or publicly known. B) A question asked during initial account setup to verify identity. C) A question that prompts users to create a stronger password. D) A question that tests user knowledge about cybersecurity.

25. Why is using a password like '123456' or 'qwerty' considered extremely weak?

A) These are common patterns and are among the first combinations tried in brute-force and dictionary attacks. B) They are too long for most systems to process efficiently. C) They contain special characters which are not allowed. D) They are easily guessable by authorized personnel only.

26. What is the role of a password manager in preventing credential stuffing attacks?

A) By ensuring each account has a unique password, so a breach in one site doesn't compromise others. B) By automatically changing passwords every day. C) By blocking all login attempts from known compromised IPs. D) By forcing users to use simple, memorable passwords.

27. When setting up a new account, what is the best approach for creating a password?

A) Use the password manager's built-in generator to create a strong, unique password. B) Use a variation of a previous password. C) Use your username or email address. D) Use a common, easily memorable word.

28. What is a potential risk associated with using a password manager that is not password-protected itself?

A) If the device is lost or stolen, all stored passwords could be accessed. B) It would prevent the user from accessing any websites. C) It would automatically delete all saved passwords. D) It would require manual password entry for every site.

29. What is the principle behind 'password aging'?

A) Requiring users to change their passwords periodically to reduce the risk of compromise. B) Allowing passwords to expire after a certain period. C) Tracking the age of a password to determine its strength. D) Limiting the number of times a password can be used.

30. Which of the following is an example of a strong password?

A) MyDogFluffy1 B) Summer2024! C) P@$$wOrd123 D) Tr3@$ur3_M@p_7!

31. What is a 'keylogger' and how can it compromise password security?

A) A type of malicious software that records keystrokes, potentially capturing passwords as they are typed. B) A tool that generates strong passwords automatically. C) A network device that encrypts data transmission. D) A security feature that blocks unauthorized access.

32. What is a 'social engineering' attack related to passwords?

A) Manipulating individuals into divulging confidential information like passwords. B) Using algorithms to guess passwords. C) Exploiting software vulnerabilities to steal passwords. D) Intercepting passwords transmitted over networks.

33. When using Two-Step Verification, what should you do with backup codes?

A) Store them in a secure, offline location, separate from your primary device. B) Delete them immediately after receiving them. C) Share them with trusted family members for emergency access. D) Store them in your password manager.

34. What is the main advantage of using a password manager for generating passwords?

A) It can create extremely long and complex passwords that are difficult for humans to remember but strong against attacks. B) It allows users to create simple passwords that are easy to type. C) It ensures all generated passwords are based on personal information. D) It uses a limited set of characters to improve compatibility.

35. Which of the following is a weak password strategy?

A) Using a different password for every online service. B) Creating passwords with at least 12 characters, including a mix of character types. C) Using a password manager to store and generate passwords. D) Using common words or phrases like 'password' or '123456'.

36. What is the purpose of the 'password strength meter' often found on websites?

A) To provide real-time feedback on how secure the chosen password is. B) To automatically enforce password complexity rules. C) To suggest a password based on user input. D) To track the number of failed password attempts.

37. Why is it important to log out of accounts when using a shared or public computer?

A) To prevent the next user from accessing your account or sensitive information. B) To speed up the computer's performance. C) To clear the browser's cache. D) To ensure the computer restarts automatically.

38. What is a 'credential stuffing' attack?

A) An attack where attackers use lists of stolen username-password combinations from one breach to try and log into other unrelated services. B) An attack that involves encrypting a user's files and demanding a ransom. C) An attack that exploits a flaw in a website's login form. D) An attack that uses social engineering to trick users into revealing credentials.

39. Which of the following is a characteristic of a secure password manager?

A) End-to-end encryption and a strong master password requirement. B) Cloud storage without any encryption. C) Sharing of user passwords among users. D) Use of default or easily guessable master passwords.

40. What is the primary goal of implementing Two-Step Verification?

A) To ensure that even if a password is stolen, the account remains protected. B) To allow users to bypass password requirements. C) To increase the complexity of password creation. D) To encrypt all data stored on the user's device.

41. What is a 'session cookie' in relation to password security?

A) A small piece of data stored by the browser that maintains a user's logged-in state for a session, which can be a risk if not managed securely. B) A type of password used for secure online sessions. C) A software that generates temporary passwords. D) A security protocol for encrypting web traffic.

42. Why is it advised NOT to save your password in your web browser if you are using a public or shared computer?

A) Other users of the computer could easily access your saved passwords. B) Browsers do not support saving passwords on public computers. C) It significantly slows down your internet connection. D) It automatically logs you out of your accounts.

43. What is a 'rainbow table attack' mitigated by?

A) Salting passwords before hashing. B) Using very short passwords. C) Not using any special characters in passwords. D) Sharing passwords across multiple accounts.

44. What is the most secure method for managing a large number of complex passwords?

A) Using a reputable password manager with a strong master password and MFA. B) Writing them down in a physical notebook kept in a safe. C) Using a single, very strong password for all accounts. D) Memorizing all individual complex passwords.

45. What is a common recommendation for how often to change your password?

A) Periodically (e.g., every 90 days) or immediately if compromised. B) Only when you forget it. C) Daily. D) Never, if it is strong enough.

46. When implementing Two-Step Verification, which method is generally considered more secure than SMS codes?

A) Authenticator apps or hardware security keys. B) Security questions. C) Email codes. D) Password hints.

47. What is the primary function of a password hashing algorithm?

A) To convert a password into a fixed-size string of characters (hash) that cannot be easily reversed back to the original password. B) To encrypt passwords for secure transmission over a network. C) To generate random passwords for users. D) To store passwords in a human-readable format.

48. If a website offers Two-Step Verification, what should you do?

A) Enable it immediately to add an extra layer of security. B) Ignore it if you have a strong password. C) Only enable it if required by the website. D) Use it only on less important accounts.

49. What is the main security benefit of using a password manager's auto-fill feature?

A) It prevents keyloggers from capturing your password by bypassing direct typing. B) It automatically logs you into websites without needing to click. C) It encrypts your login credentials before sending them. D) It allows you to use simpler passwords.

Password Management - secure password guidelines, two-step verification, password managers - Online Test

Test Results