A cloud application's sign-in page asks for a password and then for the answer to a personal security question. The vendor markets this as multifactor authentication. How should the security architect assess the claim?
Select an answer to reveal the explanation.
Short Explanation
Two locks that open with the same kind of key aren't really two locks. A password and a security question are both something you know, so a phisher or a social media search can get both. Real MFA mixes categories: know, have, are.
Full Explanation
Multifactor authentication requires evidence from at least two different factor categories: something you know (password, PIN, security answer), something you have (hardware token, authenticator app bound to a device, smart card) and something you are (biometric). A password followed by a security question is two instances of the knowledge factor, which is better described as multi-step or two-step knowledge authentication. Both secrets are vulnerable to the same attacks, including phishing pages that ask for both, and security answers are frequently discoverable from public sources. Verifying the two prompts separately does not change their category; an attacker who phishes one can phish the other in the same session. Storing the answer hashed protects it at rest in the database, but hashing does not convert a knowledge factor into a possession or inherence factor. A CAPTCHA distinguishes humans from automated scripts; it does not identify which human is signing in and is not an authentication factor at all. Exam caveat: some exam items also treat location or behaviour as contextual signals; they can strengthen risk-based decisions but are not a substitute for a second category of factor. Operational check: review the application's authentication policy and confirm that the second step requires a device-bound authenticator or a biometric unlocked locally, and that knowledge-based recovery questions cannot be used to bypass it.