Protect each account without sharing its secrets.
Practise unique passwords, MFA factors, private sign-in codes and password-manager use. Counts reflect four scenarios, without certifying account security.
Four original scenarios each count one correct answer. Your count out of four describes this edition only; it is not a security certification, percentile, or prediction that an account is safe.
Four distinct account decisions
This group separates password reuse, authentication factors, one-time codes and managing many credentials. A password identifies a secret you know; a registered security key supplies a possession factor. A username or email address normally names the account. Saying these roles aloud can clarify why two text fields are not automatically two-factor authentication.
Separate reused credentials
Suppose one exposed password is also used for a second service. Changing only the first leaves the reused secret active elsewhere. Go independently to each affected service, set different strong passwords, and enable supported MFA. A password manager can help create and track unique credentials. Protect the manager itself and follow its provider’s setup instructions.
Locate the mistaken assumption
If you missed the code scenario, check whether the caller’s claimed job title substituted for verification. A code can complete an attacker’s login, even if it expires soon. If you missed the MFA scenario, distinguish different factor categories from repeating knowledge checks. Use the explanation to correct that specific model rather than assigning yourself a broad weak-security label.
Review a fictional account setup
Describe a setup with a unique password and a separate supported authentication factor. Rehearse declining an unexpected request for a code, then identify the service’s trusted support route. Keep all real secrets out of the exercise. For actual accounts, review available recovery options using the provider’s instructions so you do not lock yourself out.
What the result cannot prove
The FTC sources support unique credentials, password managers and MFA principles, but this is a new practice bank. No account settings are inspected and no password strength is measured. Four correct responses do not guarantee resistance to every attack. A real breach needs the affected service’s security and recovery process, not a quiz result.