IPA IP 2026 Question 71

Extra authentication triggered by a login from an unusual PC — risk-based authentication raises the level of authentication only when a login looks riskier than usual.

The site records the conditions of a user’s normal logins: the device and browser, the IP address and location, the time of day. At each login it compares the current conditions with them. If they match, the user logs in with the usual ID and password. If they differ, as with a login from a PC the user has never used, the site judges the risk to be high and asks for additional authentication, such as a secret question or a one-time code sent to the registered e-mail address. A third party who has stolen the password but logs in from another device is stopped, while the genuine user is rarely bothered.

Answer (a)

Why not others:

• •(b) — logging the user out after a period with no operation is a session timeout; it applies to every session alike and does not assess the risk of the login
• •(c) — locking the account after several wrong passwords in a row is account lockout, a countermeasure against password guessing
• •(d) — prompting a change of a long-unchanged password is a password-expiry policy, not a decision about how strongly to authenticate a login

Key rule: Risk-based authentication lets a login with the usual conditions through normally and adds authentication only when the conditions are unusual (new device, new location, odd time).

Security · AI-written, may contain errors