Practise vocabulary for multi-factor authentication and passwordless systems: TOTP, WebAuthn, FIDO2, passkeys, and adaptive MFA.
0 / 15 completed
1 / 15
MFA (Multi-Factor Authentication) combines factors from at least two of the following categories: ___, possession, and inherence.
The three MFA factor categories are: Knowledge (something you know — password, PIN), Possession (something you have — hardware token, phone), and Inherence (something you are — fingerprint, face recognition).
2 / 15
TOTP generates a ___ that changes every 30 seconds based on a shared secret and the current time.
TOTP (Time-based One-Time Password) generates a 6-digit code that's valid for 30 seconds, calculated from a shared secret and the current Unix timestamp. Google Authenticator and Authy implement TOTP.
3 / 15
WebAuthn allows a user to authenticate using a ___ stored on their device or a hardware security key, without a password.
WebAuthn stores a cryptographic credential (public/private key pair) on the device or security key. Authentication uses a challenge-response: the device signs a server challenge with the private key.
4 / 15
In WebAuthn, the ___ is the web application or service that the user is authenticating to.
The Relying Party (RP) is the website or application relying on WebAuthn for authentication. It verifies the authenticator's response against the stored public key.
5 / 15
___ MFA steps up the authentication requirements dynamically based on risk signals like unusual location or sensitive action.
Adaptive MFA (also called risk-based MFA) evaluates context signals — login from a new country, accessing sensitive data, unusual time — and increases authentication requirements only when risk is elevated.
6 / 15
Code Review Comment: 'I'm not sure about this MFA implementation. The PR mentions using TOTP, but the service is still prompting for a password as a fallback. Shouldn't WebAuthn be the primary authentication method here to reduce our attack surface?'
This question tests understanding of WebAuthn's role in MFA. The core principle is that WebAuthn should be the *primary* authentication method when available, minimizing reliance on passwords. The mistake here is assuming TOTP is suitable as a sole fallback; it's best to prioritize stronger methods like WebAuthn for enhanced security.
7 / 15
Slack Message from @Alice: 'Just deployed the new user onboarding flow. We've integrated MFA using a TOTP app. Users will be prompted to scan a QR code with their authenticator and then enter the generated code. It's much more secure!'
This assesses whether the developer understands the basic functionality of TOTP-based MFA. Alice's statement correctly describes the process: generating a QR code and requiring users to input the corresponding code from their authenticator app, representing an added security layer.
This tests recognition of an MFA-related API response. The `mfa_required: true` field signifies that MFA is needed for this specific request. The `totp_code_challenge` value represents the data required by the client to generate the TOTP code.
9 / 15
PR Description: 'Implemented MFA using WebAuthn. The backend now uses a hardware security key for authentication. Users are prompted to touch their key when logging in. This significantly reduces the risk of brute-force attacks and phishing attempts. The WebAuthn library handles all key management.'
This question assesses understanding of WebAuthn's strengths. Using a hardware security key dramatically improves MFA compared to TOTP apps because keys are much more resistant to compromise and phishing attacks. The description highlights this enhanced security posture.
10 / 15
Standup Update from @Bob: 'I'm working on integrating dynamic MFA for our admin panel. We're using risk signals – like unusual login locations or large data transfers – to trigger a more demanding authentication challenge, such as requiring a push notification to their mobile device. It's a complex process!'
This explores the concept of adaptive/dynamic MFA. The description correctly outlines a system where authentication challenges are adjusted based on risk signals – a more sophisticated approach than static MFA. This demonstrates an understanding that MFA shouldn't be a 'one-size-fits-all' solution.
11 / 15
Code Review Comment: 'I'm not sure about this MFA implementation. The PR mentions using TOTP, but the service is still prompting for a password as a fallback. Shouldn't WebAuthn be the primary authentication method here to reduce our attack surface?'
This question tests understanding of WebAuthn's role in MFA. The core principle is that WebAuthn should be the *primary* authentication method when available, minimizing reliance on passwords. The mistake here is assuming TOTP is suitable as a sole fallback; it's best to prioritize stronger methods like WebAuthn for enhanced security.
12 / 15
Slack Message from @Alice: 'Just deployed the new user onboarding flow. We've integrated MFA using a TOTP app. Users will be prompted to scan a QR code with their authenticator and then enter the generated code. It's much more secure!'
This assesses whether the developer understands the basic functionality of TOTP-based MFA. Alice's statement correctly describes the process: generating a QR code and requiring users to input the corresponding code from their authenticator app, representing an added security layer.
This tests recognition of an MFA-related API response. The `mfa_required: true` field signifies that MFA is needed for this specific request. The `totp_code_challenge` value represents the data required by the client to generate the TOTP code.
14 / 15
PR Description: 'Implemented MFA using WebAuthn. The backend now uses a hardware security key for authentication. Users are prompted to touch their key when logging in. This significantly reduces the risk of brute-force attacks and phishing attempts. The WebAuthn library handles all key management.'
This question assesses understanding of WebAuthn's strengths. Using a hardware security key dramatically improves MFA compared to TOTP apps because keys are much more resistant to compromise and phishing attacks. The description highlights this enhanced security posture.
15 / 15
Standup Update from @Bob: 'I'm working on integrating dynamic MFA for our admin panel. We're using risk signals – like unusual login locations or large data transfers – to trigger a more demanding authentication challenge, such as requiring a push notification to their mobile device. It's a complex process!'
This explores the concept of adaptive/dynamic MFA. The description correctly outlines a system where authentication challenges are adjusted based on risk signals – a more sophisticated approach than static MFA. This demonstrates an understanding that MFA shouldn't be a 'one-size-fits-all' solution.
What will I practise in "MFA & Passwordless Authentication Language"?
Practise vocabulary for multi-factor authentication and passwordless systems: TOTP, WebAuthn, FIDO2, passkeys, and adaptive MFA.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.