IPA IP 2022 Question 82

Topic: Security

A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問82, translated into English. ITPEC is based on the same exams.

Company A performs user authentication for its internal system by using employees’ user IDs and passwords. In order to strengthen security, the company has decided to add one (1) new authentication function to this system. Among the authentication functions A through C, which of the following lists all and only the functions that make the authentication two-factor authentication when added to this system?

AAuthentication that reads the IC card issued to the employee as Company A’s employee ID cardBAuthentication that has the user enter the answer to a secret question that has been registered in the system in advance and that only the user knowsCAuthentication that compares the features of the user’s face that have been registered in the system in advance with the features of the face read by a camera at the time of authentication

Explanation

Functions A and C — a second factor must be of a different kind from the password, which is something the user knows.

The three factors of authentication are knowledge (something you know: a password, a PIN, a secret question), possession (something you have: an IC card, a phone) and inherence (something you are: a face, a fingerprint). Two-factor authentication combines two different factors; two checks of the same factor stay single-factor.

  • •A: the employee ID IC card is possession, a new factor, so ID and password plus the card is two-factor
  • •B: the answer to a secret question is knowledge, the same factor as the password, so it stays single-factor
  • •C: the face is inherence (biometrics), a new factor, so it is two-factor

Answer (c)

Why not others:

  • •(a) — leaves out C: face recognition is biometric, a factor different from the password
  • •(b) and (d) — include B: a secret question is something the user knows, like the password, so the system still uses only the knowledge factor

Key rule: Count factors by kind, not by number of checks: password plus secret question is one factor twice, password plus card or face is two factors.

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.