Questions: Online Account Management

Question 1

An attacker successfully steals your password for an account protected by an authenticator app. What can the attacker do?

• A. Log in immediately using the stolen password
• B. Log in by requesting a password reset email
• C. Log in only if they also have physical access to your phone
• D. Log in by calling your mobile carrier

Answer: (C)

With 2FA enabled, a password alone is insufficient. An authenticator app generates time-based codes on your physical device — to log in, an attacker would also need your phone in hand. This is the core protection 2FA provides: even if they obtain your password (something you know), they cannot proceed without the second factor (something you have). Remote attacks that steal passwords are stopped cold.

Question 2

You enabled SMS text-message codes on your banking account. A friend says SMS 2FA is just as secure as an authenticator app. Are they correct?

• A. Yes — both require a phone, so they offer equal security
• B. Yes — SMS is actually more secure because codes are sent from outside your device
• C. No — SMS can be bypassed via SIM swap attacks; authenticator apps generate codes locally and are significantly more secure
• D. No — but only because authenticator apps are free and more convenient

Answer: (C)

SMS 2FA is better than no 2FA, but it has a known vulnerability: SIM swap attacks, where an attacker convinces your mobile carrier to transfer your phone number to a device they control. They then receive your SMS codes. Authenticator apps generate time-based codes locally using a cryptographic seed — an attacker needs physical possession of your device. This is a meaningful security difference, especially for high-value accounts.

Question 3

Your email account should be the top priority for enabling 2FA because email is used to reset passwords for all your other accounts.

• T. True
• F. False

Answer: True

Email is the master key to your digital identity. If an attacker compromises your email account, they can trigger 'forgot password' resets for every other account you own — banking, social media, shopping, and more. Protecting email with 2FA matters more than 2FA on any single downstream account.

Question 4

Inactive online accounts you no longer use can seldom be compromised, so there is no reason to delete them.

• T. True
• F. False

Answer: False

Inactive accounts remain security liabilities. When a service gets breached, your old username and password combination gets exposed. Attackers use those credentials in 'credential stuffing' — automatically testing them against active services (banking, email, etc.). Old accounts also retain personal data that can be misused. Deleting unused accounts reduces your attack surface even if you never think about those accounts anymore.

Question 5

Explain why two-factor authentication provides significantly stronger protection than a strong password alone.

Model answer: A password is a single secret (something you know). If it is stolen, guessed, or leaked in a breach, anyone can use it remotely. 2FA adds a second factor — something you physically have (a phone or hardware key) — that an attacker cannot obtain remotely. Even with the correct password, they cannot log in without physical access to your second factor, defeating phishing, credential stuffing, and brute-force attacks.

Security in layers means each factor eliminates a category of attack. A strong password stops guessing attacks. 2FA stops remote attacks that obtain the password by other means. Together they require an attacker to both know your secret AND physically possess your device — a far higher bar that eliminates the vast majority of real-world account compromises.