ITPEC FE Morning April 2018 Question 42

IC Card + PIN Authentication — PIN must be delivered through a separate channel from the IC card.

IC card + PIN is a two-factor authentication method combining something you have (the card) with something you know (the PIN). The core security principle is that these two factors must never travel together — if intercepted simultaneously, both factors are compromised.

Correct answer: d) When an IC card is delivered, the PIN is not enclosed but is notified to the user through another channel. This ensures that even if the card is intercepted during delivery, the attacker cannot use it without the PIN.

Why not the others:

• •a) A common PIN for all users defeats the purpose of individual authentication — any cardholder could impersonate another.
• •b) The lost IC card must be deactivated before issuing a new one, not after. Leaving the lost card active during the reissue process creates a security window.
• •c) Deriving the PIN from information printed on the card's surface means anyone who sees the card can determine the PIN, eliminating the "something you know" factor entirely.

Key rule: In two-factor authentication, each factor must be delivered and stored independently to prevent single-point compromise.

AI-generated — may contain errors