ITPEC FE Morning October 2022 Question 42

Tune the device to balance false rejection against false acceptance — every biometric system trades one error rate for the other.

A biometric match is never exact, so the device accepts a sample when its similarity passes a threshold. Two error rates follow from that threshold:

• •FRR (false rejection rate): an authorized user is rejected
• •FAR (false acceptance rate): an unauthorized person is accepted

A stricter threshold lowers FAR but rejects more genuine users; a looser one does the reverse. When the system is introduced, the threshold has to be set with both rates in mind, according to how much security and how much convenience the use requires.

Answer (a)

Why not others:

• •(b) — malware definition files belong to antivirus software; updating them has no effect on how often a fingerprint or face is wrongly rejected
• •(c) — a digital certificate issued by a certificate authority binds a public key to its owner; it is PKI authentication, not biometrics
• •(d) — balancing memorability against guessability is the design of passwords and PINs, knowledge-based authentication, whereas biometrics uses what the person is

Key rule: Biometric accuracy is a threshold setting: FAR and FRR move in opposite directions, so the operating point is chosen for the application rather than either rate driven to zero.

Security · AI-written, may contain errors