Unit IV Checkpoint: Lock Down an Account

Where you are: Unit IV — Authentication: Passwords, Hashes and Beyond · Checkpoint · About 12 minutes. This checkpoint draws on Chapters 2 and 9 to 12 of Dr. Al-Doori's Cyber Security Essentials and Lessons 4.1 to 4.7.

Model answer

c is right. The alert itself could be phishing, so Layla reaches each site by typing the address or using a bookmark. The exposed password must be replaced everywhere it was used, because credential stuffing will try it on other sites; her email comes first among those, because email can reset everything else. Each account gets its own generated password from a password manager. Finally, signing out other sessions, adding MFA or a passkey, and checking that the recovery email and phone are still hers closes the doors an attacker might already have opened.

• a trusts a link in an unexpected email and leaves two accounts exposed to credential stuffing.
• b waits until the damage is done, and repeats the reuse that caused the problem.
• d protects email but leaves the breached site and the shopping site open.

Model answer

b is right. A prompt Daniel did not start means someone almost certainly has his password and is hoping he will approve out of tiredness: this is MFA fatigue. The rule is never to approve a prompt you did not start. Denying blocks this attempt; changing the password stops the attacker from generating more. Checking activity and signing out other sessions removes any access already gained. A passkey, or an app that uses number matching, makes this attack much harder in future. If it were a work account, he would also report it to IT.

• a hands the attacker the account; approving to make the prompts stop is exactly what the attack relies on.
• c removes the one control that just protected him, leaving a known-stolen password as the only lock.
• d wastes time, and replying to an email is not a safe way to reach a provider during an attack.

Model answer

d is right. A passkey sits in Tier 1: it provides phishing-resistant authentication because the credential is cryptographically bound to the legitimate service, so a look-alike page has nothing to collect. Authenticator app codes are a strong Tier 2 backup if she cannot use the passkey. Recovery codes stored in her password manager (or printed and kept safely) and a well-protected recovery email mean she can get back in if she loses her phone, without leaving a weak back door. SMS is Tier 3: better than a password alone, but open to phishing and SIM swapping, so she does not rely on it when stronger options exist. If she does keep SMS, a carrier account PIN reduces the SIM-swap risk.

• a chooses the weakest tier when two stronger ones are available.
• b leaves a single password guarding the account that can reset all her others.
• c is a reasonable method, but with no backup or recovery plan, losing her phone could lock her out of her most important account.