ITPEC FE Morning October 2019 Question 43

The iris and a password — two-factor authentication combines factors from two different categories.

Authentication factors fall into three categories:

• •Knowledge: something you know, such as a password or PIN
• •Possession: something you have, such as an IC card or a token
• •Inherence: something you are, such as a fingerprint, iris or face

The iris is an inherence factor and the password a knowledge factor, so option (d) uses two different categories. An attacker who steals the password still lacks the iris, and the other way round.

Answer (d)

Why not others:

• •(a) — two passwords are two knowledge factors; one attack that captures what the user knows, such as phishing or a keylogger, can get both
• •(b) — one password, however many kinds of special characters it contains, is still a single knowledge factor; complexity makes it harder to guess but adds no factor
• •(c) — two fingerprints are both inherence factors of the same kind, so only one category is used

Key rule: Count categories, not items: two-factor means two of know, have and are; two items of the same category are still single-factor.

Security · AI-written, may contain errors