ITPEC FE Subject A April 2025 Question 30

The PIN is sent to the user through another channel — the card and the PIN are two separate factors, so they must never travel together.

Card-plus-PIN authentication combines something you have with something you know. If the PIN were enclosed with the card, anyone who intercepted the delivery would hold both factors at once. Sending the PIN by a different route, such as a separate letter or a later message, means one intercepted item is not enough.

Answer (d)

Why not others:

• •(a) — a common PIN makes the "something you know" factor known to every user, so anyone holding someone else's card could use it
• •(b) — the lost card is deactivated last, after the reissue and PIN reset, which leaves it usable in the meantime; it should be deactivated as soon as the loss is reported
• •(c) — a PIN built from numbers printed on the card is known to whoever holds the card, so the second factor adds nothing

Key rule: Keep the factors of multi-factor authentication independent in how they are issued, delivered and stored.

Security · AI-written, may contain errors