ITPEC FE Subject A April 2025 Question 30
ITPEC FE Subject A April 2025 — Question 30 of 60
IC card + PIN authentication — proper handling of two-factor authentication (something you have + something you know).
The PIN must be delivered through a separate channel from the IC card itself. If both are sent together, an interceptor gains both authentication factors at once, defeating the purpose of two-factor authentication.
Why not others:
- (a) A common PIN for all users eliminates individual authentication — if one PIN is compromised, all accounts are exposed
- (b) The lost IC card must be deactivated first before issuing a new one — leaving the old card active during reissuance is a security gap
- (c) Deriving the PIN from information printed on the card surface means anyone who physically sees the card can deduce the PIN, destroying the "something you know" factor
Key rule: In two-factor auth, the two factors must always be delivered and stored through independent channels.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.