ITPEC IP April 2026 Question 42
Which of the following is an appropriate description concerning the characteristics of the authentication method below?
- •Users memorize only the positions and their order on the matrix table used for authentication.
- •Numbers are randomly allocated on the matrix table every time authentication is performed.
- •A user enters numbers that are shown in memorized positions, in order, as a password.
- •Authentication succeeds when input of numbers displayed in the correct positions has been confirmed.
[Example of authentication by using a matrix]
Note: The shaded portions indicate memorized positions, and the arrows indicate the memorized order.
Explanation
Effective against spoofing with a tapped password — the digits typed change at every login, so a password captured once is useless the next time.
The lasting secret is only the pattern: which cells, in which order. In the example the pattern reads 5, 0, 2, 5 from the first matrix, so the password is 5025. At the next authentication the numbers are reshuffled and the same cells give 3059. An attacker who taps the line or watches the keyboard learns 5025, but replaying it fails, because the matrix will show different numbers in those cells. This is matrix authentication, a kind of one-time password.
Answer (c)
Why not others:
- •(a) — the positions and their order are the password itself; like any password they should be changed regularly, since someone who watches several logins can work them out
- •(b) — telling the positions and order to others hands over the whole secret; with them anyone can read the right digits off any matrix
- •(d) — the user proves something they remember, a pattern, which is knowledge-based authentication; biometric authentication uses a body feature such as a fingerprint or iris
Key rule: A one-time response computed from a fixed secret defeats replay of a captured password, but the secret pattern still has to be kept private and changed like any password.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.