What the standard says
A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:
Where this one sits
This is a Level AAA criterion. Level AAA is not required by the European Accessibility Act or EN 301 549, and W3C itself does not recommend it as a site-wide target — so we have kept our commentary to the A and AA set rather than padding out pages we cannot improve on.
How A11ySignal checks it
manual
No automated rule can judge this criterion, and we will not pretend otherwise. A clean scan does not mean 3.3.9 passes — it means nothing we can measure fails. This one needs a person.