English
Menu

Information Security Basics

Of the three factors of authentication used to verify a user (knowledge, possession and inherence), which one applies to authentication with an employee ID smart card?

  1. AKnowledge factor
  2. BPossession factor
  3. CInherence (biometric) factor
Show answer and explanation

Answer: B. Possession factor

Authentication factors fall into three types: something only the person knows (knowledge: passwords, PINs, security questions, etc.), something only the person has (possession: smart cards, smartphones, dedicated authentication devices, etc.) and characteristics of the person's body or behavior (inherence: fingerprints, face, vein patterns, etc.). A smart card verifies the person by the fact that they have it, so it is a possession factor. Because a lost or stolen card could be used by someone else, possession factors are often combined with knowledge such as a PIN, which makes it multi-factor authentication.

  • A. Knowledge factors use information only the person knows, such as passwords or PINs.
  • B. Correct. A smart card verifies the person by possession of the card, so it is a possession factor.
  • C. Inherence factors use characteristics of the person's body, such as fingerprints or face.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. Which of the following authentication methods is multi-factor authentication?
  2. In fingerprint-based biometric authentication, the threshold on the matching score required to accept a user as genuine is made stricter (higher). Which change generally occurs?
  3. A face recognition device can be set to one of three thresholds, A, B and C, with a false acceptance rate (FAR) and false rejection rate (FRR) of 1% and 0.5% for A, 0.1% and 2% for B, and 0.01% and 8% for C. For controlling entry to a laboratory, the requirement is a FAR of 0.1% or less, and within that, legitimate users should be rejected as rarely as possible. Which threshold should be chosen?
  4. Which statement correctly describes single sign-on (SSO)?
  5. Which practice follows the principle of least privilege?