After this lesson, try to
- Distinguish knowledge, possession and inherence factors.
- Recognize why two passwords are not MFA.
- Separate framework-specific password guidance, recovery and session revocation.
Understand the evidence being checked
Authentication can use something known, possessed or inherent to the person. Multi-factor authentication combines different factor categories; two passwords are still knowledge factors. A particular implementation’s strength also depends on enrollment, recovery, device protection and the method’s resistance to phishing. Not all MFA has the same properties.
Use the current NIST password excerpt within its scope
NIST SP 800-63B-4 sets a minimum of 15 characters when a password is a single authentication factor, and at least 8 when it is used only within MFA. Its selected verifier rules reject additional character-composition requirements and arbitrary periodic changes; a change is required when there is evidence of compromise. The excerpt also rejects prompting for security questions when choosing passwords. These are requirements within that NIST framework, not a universal EU law or a claim that the CC exam tests a particular number.
Keep the surrounding account controls in view
Use distinct credentials and protect access to them. A strong password does not make a deceptive sign-in page trustworthy. Authentication success does not authorize every action, and resetting a password is not necessarily the same as revoking all existing sessions or tokens. Recovery and removal need their own controls.
Make it your own.
Compare two fictional sign-in designs. Identify factor categories and what to check after a compromised password changes.
Use fictional information. Writing an answer helps expose assumptions; this exercise is not independently marked.
Connect the terminology.
What to take further.
Coverage and remaining teaching
- This site does not teach complete authenticator enrolment, recovery, assurance-level requirements or phishing-resistant deployment.
Practice and feedback
- Use fresh authentication cases and a suitably supervised lab; this site does not review a real password or MFA configuration.
Free and paid resources
These editorial lessons are free to read. Commercial CC teaching is optional; exam and credential-maintenance charges are separate. Confirm current issuer terms before paying.
A reading acknowledgement tracks your place; it does not establish competence or course completion.