IPA IP 2020 Question 86
A question IPA Japan published in 令和2年度 10月 ITパスポート試験 公開問題 問86, translated into English. ITPEC is based on the same exams.
Which of the following is the most appropriate explanation of two-factor authentication?
Explanation
Two of the three kinds: possession, memory and biometrics — two-factor authentication combines two different kinds of authentication factor.
Authentication factors fall into three kinds:
- •Something you have (possession): an IC card, a smartphone receiving a one-time password, a hardware token
- •Something you know (memory): a password, a PIN, the answer to a secret question
- •Something you are (biometric information): a fingerprint, a face, a vein pattern
Two-factor authentication uses two different kinds, such as an IC card plus a PIN. An attacker who steals one factor, a leaked password for example, still lacks the other.
Answer (a)
Why not others:
- •(b) — several feature points of one fingerprint or signature are still one factor, biometrics; it describes how biometric matching works
- •(c) — a password mixing character types is still only something you know; it describes password complexity rules
- •(d) — logging in once to use several systems is single sign-on (SSO)
Key rule: Factors count by kind, not by number: a password and a PIN are both memory, so together they are not two-factor authentication.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.