ITPEC FE Subject A April 2026 Question 28
ITPEC FE Subject A April 2026 — Question 28 of 60
Password plus a one-time code from a smartphone app — two different categories of evidence.
Authentication factors come in three kinds:
- •Knowledge — something you know: password, PIN, security answer
- •Possession — something you have: smartphone, token, smart card
- •Inherence — something you are: fingerprint, face, iris
A password is knowledge and the one-time code proves possession of the phone, so the combination spans two categories.
Answer (c)
Why not others:
- (a) — a security answer and another thing the user knows are both knowledge; that is multi-step, not multi-factor
- (b) — fingerprint and other biometrics are both inherence, again a single category
- (d) — a username identifies the account rather than authenticating it, leaving the password as the only factor
Key rule: Count categories, not steps. Two secrets of the same kind fall to the same attack, which is precisely what multi-factor is meant to prevent.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.