IPA IP 2021 Question 60
A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問60, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate example of two-step authentication in an information system?
Explanation
After the user ID and password are accepted, the answer to a secret question is also required — two-step authentication checks the user in two separate stages.
In two-step authentication, login is allowed only after the user passes a second check that follows a successful first authentication. Here the user ID and password are the first step and the secret question the second. Both are things the user knows, so this is two-step but not two-factor authentication: two-step counts the stages, two-factor counts the kinds of factor (something you know, have or are).
Answer (c)
Why not others:
- •(a) — reading a distorted string is a CAPTCHA: it checks that a human rather than a program is at the keyboard, not who the user is, so the user is authenticated only once
- •(b) — authentication at entry and again at exit (anti-passback) are checks for two different actions, not two stages of one authentication
- •(d) — a user ID only names who claims to log in; splitting the ID and the password over two screens is still a single authentication by the password
Key rule: Two-step authentication is two verification stages in sequence for one access; two-factor authentication uses two different kinds of factor; a CAPTCHA tests for a human, not an identity.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.