Multi-Factor Authentication and Password Protection
Key Takeaways
Subdomain 2.3 names password protection; the CC outline page names MFA basics under Domain 3.
Multi-factor authentication requires more than one factor; two passwords are not two factors.
Protect passwords by not sharing them and by treating a suspicious sign-in request as a potential compromise.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 2.3, and the CC outline page, checked 2026-10-22.
Multi-Factor Authentication
The CC outline page states that candidates understand the foundational concepts of Multi-Factor Authentication (MFA). MFA means verifying identity with more than one factor from different categories, such as something the user knows and something the user has. Two passwords belong to the same category and do not meet that standard.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Password Protection
Subdomain 2.3 names password protection as an awareness concept. Do not share passwords or reuse them across systems. Reporting a sign-in prompt the user did not start is general practice, not an outline item. The outline does not name single sign-on or federation, so study the password and MFA concepts it does list.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 2.3: Organizational culture (e.g., importance of security, security leadership)
- 2.3: Concepts (e.g., social engineering, password protection, phishing)
Common Traps
A common trap is treating awareness as only a technical control. The outline counts culture, leadership, social engineering, and password protection as awareness concepts, so answer with the people behavior the scenario calls for.
Which combination is multi-factor authentication?
A password and a one-time code from a device the user holds
Two different passwords typed in sequence at the same login screen during one session
A username and a second username entered together on the same login screen for each access
A password and a security question with the same answer that is written on the account record
Sections you finish are checked off in the contents.