{
  "id": "08",
  "content": [
    {
      "type": "heading",
      "text": "MFA Enforcement & Step-Up Auth"
    },
    {
      "type": "text",
      "html": "<pre><code class='language-php'>if($user['role']==='admin' &amp;&amp; !$user['mfa_enrolled']){\n  header('Location: /account/mfa-setup.php'); exit;\n}\n</code></pre>"
    },
    {
      "type": "text",
      "html": "<pre><code># .htaccess: force HTTPS + HSTS\nRewriteEngine On\nRewriteCond %{HTTPS} !=on\nRewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]\n&lt;IfModule mod_headers.c&gt;\nHeader always set Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\n&lt;/IfModule&gt;\n</code></pre>"
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "MFA should be required for:",
        "options": [
          {
            "id": "a",
            "text": "Admins/high-privilege users"
          },
          {
            "id": "b",
            "text": "No one"
          },
          {
            "id": "c",
            "text": "Only guests"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": "HSTS should be served over:",
        "options": [
          {
            "id": "a",
            "text": "HTTPS"
          },
          {
            "id": "b",
            "text": "HTTP only"
          },
          {
            "id": "c",
            "text": "FTP"
          }
        ],
        "correct": [
          "a"
        ]
      }
    ]
  }
}