Name common authentication weaknesses found during tests.

• A. Strong passwords and MFA everywhere.
• B. Weak passwords, default credentials, lack of MFA, poor password storage.
• C. Use of OAuth without tokens.
• D. Password policies not enforced.

Answer: (B)

Authentication weaknesses seen in tests are the concrete flaws that let attackers compromise accounts or climb laterally, and they most often show up as weak credential practices and poor protection of those credentials. Weak passwords are easy to guess or crack, so they provide quick entry. Default credentials stay in use on devices and applications because the prior owner didn’t change them, so an attacker can gain access with known combinations. The absence of multi-factor authentication removes a critical second hurdle, meaning stolen or guessed passwords are often enough to log in. Poor password storage means that if the system or database is breached, attackers can recover or cracking hashes to obtain passwords for many accounts. These together describe the common, practical authentication flaws testers repeatedly encounter and focus remediation efforts on.

The other options don’t fit as well because they describe either a security goal (strong passwords and MFA) rather than a weakness, a misconfiguration not typically framed as a common weakness, or a broader policy gap that, while related, doesn’t directly capture the most frequent concrete authentication flaws seen in practice.