2.3 - Authentication methods and account security
CompTIA A+ Core 2 objective 2.3 groups the everyday security controls that protect accounts and workstations. It starts with the three authentication factors - something you know (a password or PIN), something you have (a phone, token or FIDO2 hardware key) and something you are (a fingerprint or face) - and why combining them as multi-factor authentication (MFA) is far stronger than a password alone. You are expected to recognise MFA push approvals and the 'MFA fatigue' attack, where an attacker spams prompts hoping you tap approve. It also covers single sign-on (SSO), biometric readers, and hardening habits: auto-locking a workstation after a few minutes idle, using strong unique passwords, and - the classic exam answer - changing the default administrator password first on any new device such as a SOHO router. Expect scenario questions that ask for the single best first step.
Three factors: KNOW (password/PIN), HAVE (phone/token/FIDO2 key), ARE (fingerprint/face). MFA = combine at least two. Two exam traps: 'MFA fatigue' means an attacker spams push prompts, so never approve one you did not start; and on ANY new device the safe first move is to change the default admin password.
Practice questions
1. A fingerprint reader represents which authentication factor?
- Something you know
- Something you have
- Something you are (correct answer)
- Somewhere you are
Biometrics (fingerprint, face, iris) are 'something you are'. Passwords=know, tokens/phones=have.
2. What does Single Sign-On (SSO) provide?
- One shared password used by everyone
- One login that unlocks many systems (correct answer)
- Full encryption of the system disk
- A perimeter network firewall
SSO lets a user authenticate once and access multiple connected applications/services. Pair it with MFA.
3. A user logs in with a password, then approves a push notification on their phone. Which authentication concept does the phone push represent?
- Something you know
- Something you have (correct answer)
- Something you are
- Somewhere you are
The phone (and its approval/TOTP code) is 'something you have'. The password is 'something you know'. Combining categories = multifactor authentication.
4. Which TWO practices strengthen account security the MOST? (Choose two.)
- Require multifactor authentication (correct answer)
- Reuse one strong password everywhere
- Disable the screen lock
- Enforce a strong, unique password policy (correct answer)
MFA plus strong, unique passwords dramatically reduce account compromise. Reusing passwords and disabling locks weaken security.
5. A laptop should lock itself after a few minutes of inactivity. Which setting enforces this?
- A screensaver that never locks the session
- A screen lock with an inactivity timeout (correct answer)
- The display brightness dimming setting
- The device's airplane radio-off mode
An automatic screen-lock timeout (often enforced by policy) requires re-authentication after inactivity.
6. Repeatedly sending MFA push prompts hoping a user taps 'approve' is called:
- A password brute-force attack
- MFA fatigue / push bombing (correct answer)
- A targeted phishing email
- Source address spoofing
MFA fatigue spams approval prompts until a user accidentally accepts — use number matching and report unexpected prompts.