mfa
AI security interview questions tagged mfa, across every topic.
4 questions · 0 unlocked for you
Concepts behind "mfa"
Explanations of the mechanisms these questions rely on.
Foundational
Passkeys, WebAuthn and Phishing ResistanceA passkey is a WebAuthn credential: a key pair whose private key stays in an authenticator and whose public key the website stores. To log in, the authenticator signs a fresh challenge together with data the browser fills in, including the site's origin, and the credential only works for the relying party ID it was created for. A look-alike domain cannot obtain a usable assertion, unlike with one-time codes or push prompts. Synced passkeys are convenient and meet NIST AAL2; device-bound keys are needed for AAL3. Recovery, fallbacks and stolen sessions remain separate problems. Identity & Access
Foundational
Infostealers and Session TheftInfostealer malware collects saved passwords, session cookies, tokens and developer credentials from a machine and uploads them as a log that is sold to people who specialise in breaking into organisations. Stolen session cookies represent logins that already passed MFA, so they can be replayed without a password or second factor. Defences make stolen secrets worthless (phishing-resistant MFA, short and device-bound sessions, no long-lived keys on endpoints), keep work access on managed devices, harden endpoints against lures such as ClickFix, and monitor stealer-log intelligence so sessions are revoked before buyers act. Detection & Response