English
Menu

Information Security Basics

Which of the following authentication methods is multi-factor authentication?

  1. AEntering a password and then entering a one-time password shown in an app on the user's own smartphone
  2. BEntering a password and then also entering the answer to a security question
  3. CEntering a more complex password that is twice as long
Show answer and explanation

Answer: A. Entering a password and then entering a one-time password shown in an app on the user's own smartphone

Multi-factor authentication combines two or more different factors among knowledge, possession and inherence. A password (knowledge) combined with a one-time password generated on the user's own smartphone (possession) uses two different factors, so it is multi-factor authentication. Even if the password leaks, an attacker cannot log in without the user's smartphone. A password and a security question are both knowledge factors, so even though they are checked in two steps, this is not multi-factor authentication (it is sometimes called two-step verification). Stacking factors of the same kind means they can be stolen together by the same method, such as tricking the user through phishing. One-time passwords can also be abused by attacks that get the user to enter them on a fake site in real time, so, as of the mid-2020s, methods with which authentication does not work on a fake site (such as FIDO2 passkeys) are spreading.

  • A. Correct. It combines two different factors: knowledge (the password) and possession (the smartphone).
  • B. Both a password and a security question are knowledge factors. With only one kind of factor, it is not multi-factor authentication.
  • C. Making the password longer still leaves authentication based on a single knowledge factor.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. In fingerprint-based biometric authentication, the threshold on the matching score required to accept a user as genuine is made stricter (higher). Which change generally occurs?
  2. A face recognition device can be set to one of three thresholds, A, B and C, with a false acceptance rate (FAR) and false rejection rate (FRR) of 1% and 0.5% for A, 0.1% and 2% for B, and 0.01% and 8% for C. For controlling entry to a laboratory, the requirement is a FAR of 0.1% or less, and within that, legitimate users should be rejected as rarely as possible. Which threshold should be chosen?
  3. Which statement correctly describes single sign-on (SSO)?
  4. Which practice follows the principle of least privilege?
  5. A company with thousands of employees manages permissions with role-based access control (RBAC). Which statement describes the idea of RBAC?