I85PREP
⌘ K
Cybersecurity Foundation study materials
Cybersecurity Foundation study resources

Cybersecurity Foundation practice questions

One question at a time. Build your Cybersecurity Foundation understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental cybersecurity principles and concepts

Which security principle states that a user should be granted only the minimum access rights needed to perform their job?

  1. Zero trust
  2. Principle of least privilege Correct answer.
  3. Separation of duties
  4. Defense in depth

Explanation

Least privilege limits each account to exactly the permissions required for its tasks, shrinking the damage a compromised or misused account can cause. Defense in depth layers controls, separation of duties splits critical tasks between people, and zero trust removes implicit trust based on network location.

Question 2Fundamental cybersecurity principles and concepts

An attacker floods a web server with a huge volume of traffic from many compromised hosts until legitimate users cannot connect. Which category of attack is this?

  1. SQL injection
  2. Distributed denial of service Correct answer.
  3. Man-in-the-middle
  4. Phishing

Explanation

A distributed denial of service attack uses many coordinated hosts to exhaust a target's bandwidth or resources so real users are denied service. Man-in-the-middle intercepts traffic, SQL injection manipulates database queries, and phishing tricks users into disclosing information.

Question 3Fundamental cybersecurity principles and concepts

Which property of the CIA triad is directly violated when an unauthorized person reads a confidential patient record?

  1. Integrity
  2. Confidentiality Correct answer.
  3. Non-repudiation
  4. Availability

Explanation

Confidentiality means information is disclosed only to authorized parties, so unauthorized reading of a record breaches it. Integrity concerns unauthorized modification, availability concerns timely access, and non-repudiation concerns proving an action occurred.

Question 4Fundamental cybersecurity principles and concepts

A user receives an email that appears to come from the IT helpdesk and asks them to confirm their password on a linked page. Which term best describes this attack?

  1. Tailgating
  2. Shoulder surfing
  3. Phishing Correct answer.
  4. Brute force

Explanation

Phishing uses fraudulent messages that impersonate a trusted party to trick recipients into revealing credentials or clicking malicious links. Tailgating is physically following someone through a door, shoulder surfing is observing a screen or keyboard, and brute force guesses credentials systematically.

Question 5Fundamental cybersecurity principles and concepts

What is the primary purpose of encrypting data at rest on a laptop disk?

  1. To keep stored data unreadable if the device is lost or stolen Correct answer.
  2. To authenticate users to the corporate network
  3. To prevent malware from being installed on the device
  4. To speed up disk read and write operations

Explanation

Encryption at rest transforms stored data into ciphertext so that someone who obtains the physical disk without the key cannot read it. It does not improve performance, block malware installation, or perform network authentication.

Question 6Fundamental cybersecurity principles and concepts

Which term describes a weakness in software or configuration that could be exploited by a threat?

  1. Vulnerability Correct answer.
  2. Threat
  3. Risk
  4. Control

Explanation

A vulnerability is an exploitable weakness, while a threat is a potential cause of harm and risk combines likelihood and impact. A control is a safeguard that reduces risk.

Question 7Fundamental cybersecurity principles and concepts

Which authentication factor category does a hardware token that generates a one-time code belong to?

  1. Something you have Correct answer.
  2. Something you know
  3. Something you are
  4. Somewhere you are

Explanation

Authentication factors are grouped as knowledge, possession, and inherence. A hardware token is a possession factor because the user must physically hold the device.

Question 8Fundamental cybersecurity principles and concepts

Which practice best reduces the impact of a successful password-guessing attack against online accounts?

  1. Sharing administrator credentials among the team
  2. Storing passwords in a plaintext database
  3. Disabling logging of failed authentication attempts
  4. Enforcing account lockout after repeated failed logins Correct answer.

Explanation

Account lockout or throttling limits how many guesses an attacker can make, making online guessing impractical. Plaintext storage, credential sharing, and disabled logging all increase exposure and reduce detection.

Question 9Fundamental cybersecurity principles and concepts

An organization requires two administrators to approve any wire transfer above a set amount. Which control principle does this implement?

  1. Separation of duties Correct answer.
  2. Need to know
  3. Job rotation
  4. Least privilege

Explanation

Separation of duties splits a sensitive transaction so no single person can complete it alone, which deters fraud and error. Least privilege limits permissions, need to know limits information access, and job rotation moves staff between roles.

Question 10Fundamental cybersecurity principles and concepts

A security team places firewalls, endpoint detection, network segmentation, and user training so that no single failure exposes everything. Which concept does this illustrate?

  1. Fail-safe defaults
  2. Implicit trust
  3. Defense in depth Correct answer.
  4. Single sign-on

Explanation

Defense in depth layers independent controls so that if one fails, others still reduce the chance or impact of compromise. Single sign-on is a convenience mechanism, fail-safe defaults concerns default deny behavior, and implicit trust is the opposite of a layered verification approach.

Question 11Fundamental cybersecurity principles and concepts

A hash function used to store passwords should have which property to slow down offline guessing?

  1. It should be identical for identical passwords
  2. It should be deliberately slow and salted per user Correct answer.
  3. It should be reversible with a shared key
  4. It should produce output shorter than the input

Explanation

Password hashing should use a deliberately expensive algorithm with a unique salt per user so attackers cannot cheaply test guesses or reuse precomputed tables. Reversibility defeats hashing, and identical unsalted outputs let attackers crack many accounts at once.

Question 12Fundamental cybersecurity principles and concepts

Which statement correctly distinguishes symmetric from asymmetric encryption?

  1. Symmetric provides no confidentiality, while asymmetric provides confidentiality
  2. Symmetric cannot encrypt bulk data, while asymmetric always encrypts faster
  3. Symmetric uses one shared key, while asymmetric uses a public and private key pair Correct answer.
  4. Symmetric uses a public and private key pair, while asymmetric uses one shared key

Explanation

Symmetric algorithms use a single shared secret key for both encryption and decryption, while asymmetric algorithms use a mathematically related public and private key pair. Symmetric ciphers are generally faster and are commonly used for bulk data.

Question 13Fundamental cybersecurity principles and concepts

An analyst finds that an employee's workstation is contacting a known command-and-control domain every hour. Which phase of incident response does this activity belong to?

  1. Eradication
  2. Recovery
  3. Lessons learned
  4. Detection and analysis Correct answer.

Explanation

Detection and analysis covers identifying and validating a potential incident, including spotting suspicious outbound beaconing. Eradication removes the threat, recovery restores normal operations, and lessons learned reviews the response after closure.

Question 14Fundamental cybersecurity principles and concepts

Why is a digital signature able to provide integrity and non-repudiation for a message?

  1. It relies on a shared secret known only to the sender
  2. It encrypts the message body so only the sender can read it
  3. It is created with the recipient's public key and verified with the recipient's private key
  4. It is created with the sender's private key and verified with the sender's public key Correct answer.

Explanation

A digital signature is generated with the sender's private key, which only the sender controls, and any recipient can verify it with the sender's public key. This binds the message to the signer and reveals any modification.

Question 15Fundamental cybersecurity principles and concepts

Which control type is a security awareness training program for employees?

  1. Physical control
  2. Compensating control
  3. Administrative control Correct answer.
  4. Technical control

Explanation

Administrative controls are management and personnel measures such as policies, training, and procedures. Technical controls are implemented in systems, physical controls protect facilities, and compensating controls substitute for a primary control.

Question 16Fundamental cybersecurity principles and concepts

A company classifies data and restricts the HR salary dataset to payroll staff only. Which data protection principle is being applied?

  1. Data minimization in transit
  2. Need to know Correct answer.
  3. Non-repudiation
  4. Availability

Explanation

Need to know limits access to information to those whose duties require it, which is exactly what restricting salary data to payroll staff achieves. Data minimization concerns collecting less data, while availability and non-repudiation address different properties.

Question 17Fundamental cybersecurity principles and concepts

Which of the following best describes the role of a DMZ in network architecture?

  1. It replaces the need for firewalls at the network perimeter
  2. It hosts internet-facing services in a segmented zone separated from the internal network Correct answer.
  3. It stores offline backups that are never connected to any network
  4. It encrypts all internal traffic between employee workstations

Explanation

A DMZ is a segmented subnet for externally reachable services so that compromise of those services does not grant direct access to the internal network. It complements firewalls rather than replacing them and has nothing to do with offline backups.

Question 18Fundamental cybersecurity principles and concepts

An attacker modifies a firmware update file so that it installs a backdoor while still passing a simple checksum. Which control would best detect this tampering?

  1. A cryptographic hash compared against a trusted published value Correct answer.
  2. A longer HTTP timeout
  3. A larger file transfer buffer
  4. A filename extension filter

Explanation

A cryptographic hash of the file compared with a trusted published value reveals any change to the content, whereas a simple checksum is weak against deliberate tampering. Extension filters, buffer size, and timeouts do not verify content integrity.

Question 19Fundamental cybersecurity principles and concepts

What is the main security benefit of network segmentation?

  1. It guarantees that no malware can ever enter the network
  2. It removes the need for user authentication
  3. It makes all traffic publicly routable
  4. It limits lateral movement by containing compromised hosts within a smaller zone Correct answer.

Explanation

Segmentation divides a network into zones with controlled traffic between them, so a compromised host cannot freely reach other systems. It does not eliminate malware, replace authentication, or make traffic public.

Question 20Fundamental cybersecurity principles and concepts

A user's password is stolen through a data breach at another website, and the attacker uses it to log in to the corporate VPN. Which control would most directly have prevented this?

  1. Increasing the minimum password length to twelve characters
  2. Rotating the VPN server's TLS certificate
  3. Blocking outbound traffic on port 443
  4. Requiring multi-factor authentication for VPN access Correct answer.

Explanation

Multi-factor authentication requires a second factor that the attacker does not obtain from the breached password, so a stolen password alone cannot grant access. Length rules and certificate rotation do not help once the password itself is known, and blocking port 443 would break legitimate services.

Question 21Fundamental cybersecurity principles and concepts

Which statement about the relationship between risk, threat, and vulnerability is correct?

  1. A threat and a vulnerability are the same thing
  2. Risk is unaffected by the presence of vulnerabilities
  3. Risk increases when a credible threat can exploit an existing vulnerability Correct answer.
  4. Risk exists only when no controls are deployed

Explanation

Risk reflects the likelihood and impact of a threat exploiting a vulnerability, so a credible threat paired with an exploitable weakness raises risk. Threats are potential causes of harm, vulnerabilities are weaknesses, and controls reduce but never fully eliminate risk.

Question 22Fundamental cybersecurity principles and concepts

An organization wants to prove that a log record was not altered after it was written. Which mechanism best supports this?

  1. Storing logs only on the originating host
  2. Deleting logs older than seven days
  3. Compressing log files to save disk space
  4. Append-only storage with cryptographic hash chaining Correct answer.

Explanation

Hash chaining links each log entry to the previous one so any later modification breaks the chain and becomes detectable, and append-only storage prevents overwriting. Compression, short retention, and local-only storage do not provide tamper evidence.

Question 23Fundamental cybersecurity principles and concepts

During a tabletop exercise, a team decides to disconnect a compromised server from the network while preserving its memory image. Which incident response phase does this action primarily represent?

  1. Containment Correct answer.
  2. Recovery
  3. Preparation
  4. Post-incident review

Explanation

Containment limits the spread of an incident while preserving evidence for investigation. Preparation happens before an incident, recovery restores normal service, and post-incident review evaluates the response afterward.

Question 24Fundamental cybersecurity principles and concepts

A security architect argues that a control should deny access by default and permit only explicitly allowed actions. Which design principle is being applied?

  1. Open design
  2. Fail-safe defaults Correct answer.
  3. Least common mechanism
  4. Psychological acceptability

Explanation

Fail-safe defaults means the system denies access unless a rule explicitly allows it, so an unanticipated case results in refusal rather than exposure. Open design, least common mechanism, and psychological acceptability address different Saltzer and Schroeder principles.

Question 25Fundamental cybersecurity principles and concepts

A public web application stores session identifiers in URLs and accepts them without expiration. Which combination of weaknesses does this most directly create?

  1. Improved integrity because URLs are hashed by proxies
  2. Strong confidentiality through URL obscurity and automatic key rotation
  3. Session exposure through logs and referrers, plus indefinite reuse of stolen sessions Correct answer.
  4. Reduced risk because session identifiers are publicly visible

Explanation

Session identifiers in URLs leak into browser history, proxy logs, and referrer headers, and without expiration a captured identifier remains valid indefinitely. URL obscurity provides no confidentiality, and visibility of identifiers increases rather than reduces risk.

Question 26Fundamental cybersecurity principles and concepts

Which principle states that a user should be granted only the minimum access rights needed to perform their job?

  1. Defense in depth
  2. Zero trust
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits each account to the permissions required for its specific tasks, shrinking the damage a compromised or misused account can cause. Separation of duties divides a task among people, defense in depth layers controls, and zero trust removes implicit trust based on location.

Question 27Fundamental cybersecurity principles and concepts

Which security property ensures that data has not been changed, either accidentally or maliciously, since it was created?

  1. Integrity Correct answer.
  2. Authenticity
  3. Confidentiality
  4. Availability

Explanation

Integrity refers to the accuracy and completeness of data and the assurance it has not been altered without authorization. Confidentiality concerns unauthorized disclosure, availability concerns timely access, and authenticity concerns the genuineness of the origin.

Question 28Fundamental cybersecurity principles and concepts

In risk terminology, what is the likelihood that a threat will exploit a vulnerability, combined with the resulting impact, called?

  1. Exposure
  2. Threat agent
  3. Control gap
  4. Risk Correct answer.

Explanation

Risk is commonly expressed as the combination of the probability of an event and its consequences, typically likelihood multiplied by impact. Exposure and threat agent are components that feed into risk rather than the combined measure itself.

Question 29Fundamental cybersecurity principles and concepts

Which type of malware self-replicates across networks by exploiting vulnerabilities without needing a user to open a file?

  1. Worm Correct answer.
  2. Spyware
  3. Trojan
  4. Rootkit

Explanation

A worm propagates autonomously by exploiting vulnerable services on reachable hosts, so it does not depend on user interaction. A trojan relies on disguise and user execution, a rootkit hides attacker presence, and spyware collects information.

Question 30Fundamental cybersecurity principles and concepts

Which of the following is an example of a preventive control?

  1. Restoring data from backup
  2. Installing a badge reader that blocks entry to a server room Correct answer.
  3. Sending an alert when a file is deleted
  4. Reviewing audit logs after an incident

Explanation

Preventive controls stop an event from occurring, and an access-controlled door physically blocks unauthorized entry. Log review and alerting are detective, while restoration is corrective.

Question 31Fundamental cybersecurity principles and concepts

What is the primary purpose of hashing a file before transmitting it?

  1. To prove who created the file
  2. To allow the receiver to verify the file was not altered Correct answer.
  3. To compress the file for faster transfer
  4. To hide the file contents from eavesdroppers

Explanation

A cryptographic hash produces a fixed-length digest that changes if the input changes, so comparing digests lets the receiver detect modification. Hashing is not encryption, compression, or proof of authorship.

Question 32Fundamental cybersecurity principles and concepts

Which authentication factor category does a fingerprint scan represent?

  1. Something you know
  2. Something you have
  3. Something you are Correct answer.
  4. Something you do

Explanation

Biometric traits such as fingerprints measure an inherent physical characteristic, which is the 'something you are' factor. Passwords are knowledge, tokens are possession, and behavioral patterns such as typing rhythm fall under 'something you do'.

Question 33Fundamental cybersecurity principles and concepts

Which document, signed by senior management, states the organization's overall intentions and direction for information security?

  1. Security policy Correct answer.
  2. Baseline configuration
  3. Business impact analysis
  4. Incident response plan

Explanation

A security policy is management's high-level statement of intent and direction, and it authorizes more detailed standards and procedures. Baselines, response plans, and impact analyses are lower-level or operational artifacts that support the policy.

Question 34Fundamental cybersecurity principles and concepts

An attacker emails a finance clerk a message that appears to come from the CEO and urgently requests a payment to a new bank account. Which attack does this describe?

  1. DNS cache poisoning
  2. Watering hole
  3. Business email compromise Correct answer.
  4. Credential stuffing

Explanation

Business email compromise impersonates an executive or trusted partner to induce an employee to transfer funds or data. It exploits authority and urgency rather than technical vulnerabilities in systems.

Question 35Fundamental cybersecurity principles and concepts

A developer must store user passwords so that a database leak does not directly reveal them. Which approach is appropriate?

  1. Encrypt each password with a shared symmetric key kept in the database
  2. Store the password in plaintext but restrict table access to administrators
  3. Encode each password with Base64 before storage
  4. Store a salted, slow hash produced by a password-hashing function Correct answer.

Explanation

Password-hashing functions such as Argon2 or bcrypt apply a unique salt and are deliberately slow, so a leaked database is costly to attack and identical passwords do not produce identical hashes. Symmetric keys stored alongside the data provide no protection once the database is compromised.

Question 36Fundamental cybersecurity principles and concepts

A company wants to ensure that a terminated employee cannot log in immediately after leaving, even if the employee keeps a valid session. Which measure is most directly effective?

  1. Enabling a lockout after five failed attempts
  2. Revoking active sessions and disabling the account at the time of termination Correct answer.
  3. Increasing the minimum password length
  4. Requiring password rotation every 90 days

Explanation

Disabling the account prevents new authentication, and revoking active sessions invalidates tokens or cookies already issued to the departing employee. Password policy changes and lockouts do not affect an already authenticated session.

Question 37Fundamental cybersecurity principles and concepts

An organization wants to reduce the risk of a single compromised administrator account taking over the whole environment. Which control best addresses this?

  1. Requiring administrators to use shared generic accounts
  2. Granting each administrator full domain rights to simplify support
  3. Disabling auditing on administrative servers to protect performance
  4. Enforcing separation of duties and unique named privileged accounts Correct answer.

Explanation

Unique named privileged accounts provide accountability, and separation of duties prevents one person from completing a critical action alone. Shared accounts destroy attribution and make containment harder.

Question 38Fundamental cybersecurity principles and concepts

During a vulnerability scan, a host is reported as running an outdated service with a known public exploit. Which factor most strongly raises the risk rating of this finding?

  1. The service runs on a nonstandard port
  2. The host has a long uptime record
  3. The host is internet-facing and the exploit is actively used in the wild Correct answer.
  4. The scan was performed outside business hours

Explanation

Risk rises when a vulnerability is reachable by attackers and has known, active exploitation, because both likelihood and potential impact increase. Port choice, scan timing, and uptime do not materially change exploitability.

Question 39Fundamental cybersecurity principles and concepts

A security analyst observes a workstation resolving a legitimate bank domain to an attacker-controlled IP address shortly after the user connected to an untrusted wireless network. Which attack is most likely?

  1. Cross-site scripting
  2. SQL injection
  3. DNS spoofing Correct answer.
  4. ARP spoofing on the local segment

Explanation

DNS spoofing supplies forged name-resolution answers so a legitimate hostname points to an attacker address. The symptom is specifically a wrong IP for a valid domain, which points to the resolution path.

Question 40Fundamental cybersecurity principles and concepts

Which practice best protects data at rest on a lost laptop?

  1. A host-based firewall
  2. Full-disk encryption with keys protected by a TPM Correct answer.
  3. A BIOS boot password only
  4. A screen lock timeout of five minutes

Explanation

Full-disk encryption renders the stored data unreadable without the key, and binding the key to a TPM makes offline extraction harder. Screen locks and firewalls protect a running system, and a BIOS password alone does not protect the disk contents.

Question 41Fundamental cybersecurity principles and concepts

A web application reflects user input into the page without encoding it, and an attacker uses this to run script in other users' browsers. Which vulnerability class is this?

  1. Cross-site request forgery
  2. Cross-site scripting Correct answer.
  3. Server-side request forgery
  4. Insecure deserialization

Explanation

Cross-site scripting occurs when untrusted input reaches the browser as executable content without proper output encoding. The script then runs in the context of the vulnerable site and can act on behalf of victims.

Question 42Fundamental cybersecurity principles and concepts

What is the main purpose of a security baseline?

  1. To define a minimum consistent set of configuration settings applied to systems Correct answer.
  2. To record every security incident for legal review
  3. To list approved vendors for procurement
  4. To describe the organization's long-term security strategy

Explanation

A baseline is a documented minimum configuration standard, such as required patch levels and disabled services, applied consistently across similar systems. It is technical and specific, unlike strategy documents or incident records.

Question 43Fundamental cybersecurity principles and concepts

An organization must keep a copy of critical backups that is not reachable from the production network, to resist ransomware. Which design best meets this?

  1. Storing immutable, offline or air-gapped backup copies Correct answer.
  2. Encrypting backups with a key stored on the production file server
  3. Replicating backups to another server in the same domain
  4. Compressing backups to save space

Explanation

Immutable or offline copies cannot be encrypted or deleted by ransomware that has compromised production credentials, so recovery remains possible. Replication within the same trust boundary spreads the compromise, and co-located keys are also exposed.

Question 44Fundamental cybersecurity principles and concepts

Which statement best describes the difference between a vulnerability assessment and a penetration test?

  1. The two terms are interchangeable because both produce a list of missing patches
  2. A vulnerability assessment is always performed by external parties, while a penetration test is always internal
  3. A vulnerability assessment identifies and prioritizes weaknesses, while a penetration test attempts to exploit them to demonstrate real impact Correct answer.
  4. A penetration test lists findings without attempting exploitation, while a vulnerability assessment proves impact

Explanation

A vulnerability assessment enumerates and prioritizes weaknesses, while a penetration test goes further by chaining and exploiting them to show achievable impact. The distinction is depth and exploitation, not who performs the work.

Question 45Fundamental cybersecurity principles and concepts

A user receives a text message claiming to be from a delivery company with a link asking for card details. Which term best describes this attack?

  1. Vishing
  2. Pharming
  3. Tailgating
  4. Smishing Correct answer.

Explanation

Smishing is phishing delivered by SMS or messaging apps, typically using a lure and a malicious link. Vishing uses voice calls, pharming redirects name resolution, and tailgating is physical intrusion.

Question 46Fundamental cybersecurity principles and concepts

An organization wants to limit the damage that a compromised internet-facing web server can do to the internal database tier. Which control is most directly applicable?

  1. Backing up the database nightly
  2. Enabling verbose error messages for faster debugging
  3. Placing the web server in a segmented zone with strict firewall rules to the database tier Correct answer.
  4. Increasing the password length for database administrators

Explanation

Segmentation with restrictive rules limits which hosts and ports the web tier can reach, containing lateral movement from a compromised server. Password length and backups do not constrain network reachability.

Question 47Fundamental cybersecurity principles and concepts

A security team must choose between accepting, transferring, mitigating, or avoiding a risk. Which action corresponds to purchasing a cyber insurance policy?

  1. Acceptance
  2. Mitigation
  3. Transfer Correct answer.
  4. Avoidance

Explanation

Risk transfer shifts the financial consequence to another party, as insurance does, without eliminating the underlying likelihood. Mitigation reduces likelihood or impact, acceptance retains the risk, and avoidance removes the activity.

Question 48Fundamental cybersecurity principles and concepts

An attacker who has compromised a low-privilege user account begins enumerating local services and stored credentials to move to other hosts. Which phase of the attack lifecycle does this illustrate?

  1. Reconnaissance
  2. Exfiltration
  3. Lateral movement preparation and privilege escalation Correct answer.
  4. Weaponization

Explanation

After initial access, attackers escalate privileges and gather credentials and reachable hosts to move laterally. Reconnaissance and weaponization occur before compromise, and exfiltration is the later theft of data.

Question 49Fundamental cybersecurity principles and concepts

A company must prove that a specific employee performed an action in a system, even if the employee later denies it. Which combination best supports this requirement?

  1. Unique per-user accounts, strong authentication, and tamper-evident logs Correct answer.
  2. Shared administrator accounts with full logging
  3. Encrypted backups of the application database only
  4. Role-based access control without authentication logging

Explanation

Attribution requires that actions map to a single authenticated identity and that the record of those actions cannot be silently altered. Unique accounts with strong authentication and tamper-evident logging provide both elements.

Question 50Fundamental cybersecurity principles and concepts

An organization applies the same strong password policy to all staff, but attackers still succeed by calling the help desk and impersonating users to reset credentials. Which conclusion best follows?

  1. The password policy is unnecessary and should be removed
  2. The organization should disable password resets entirely
  3. Longer passwords would have prevented the impersonation calls
  4. Technical controls alone are insufficient, so identity verification procedures in the help desk process must be strengthened Correct answer.

Explanation

The failure occurred in a human verification process, not in password strength, so the help desk needs robust identity proofing and callback procedures. Removing or hardening passwords does not address an attacker who convinces a person to act.