Multifactor Authentication

Question 1 of 6

A user accesses a banking application by entering a password and then entering a 6-digit code generated by an app on their smartphone. The code changes every 30 seconds. Which two authentication factors are in use, and why does this combination qualify as true MFA?

Two knowledge factors (password + code) — both are things the user knows, so this is two-step but not true MFA Something you know (password) + something you have (software token on smartphone) — factors from two different categories qualify as true MFA because compromising one factor type does not compromise the other Something you know (password) + somewhere you are (smartphone location) — the smartphone app determines location, making this a location-based second factor Two possession factors (password stored on device + token app on phone) — since both require the user's device, this is a single-factor method

Question 2 of 6

A security administrator is configuring authentication for a high-security government system. Users must present a physical card with an embedded microprocessor containing cryptographic keys, and must also enter a PIN. The card is useless without the PIN, and the PIN is useless without the card. Which authentication mechanism is this, and which two factors does it combine?

Software token + knowledge factor — the card generates a software token verified against the PIN Smart card (something you have) + PIN (something you know) — the physical card with embedded cryptographic keys combined with the knowledge of the correct PIN Biometric + knowledge factor — the embedded microprocessor reads a fingerprint embedded in the card and compares it to the PIN Hardware token + SMS OTP — the card generates a rotating OTP code that must match the PIN sent via text message

Question 3 of 6

An organization stores biometric data for fingerprint authentication. A security researcher asks what exactly is stored in the biometric database. Which answer is correct?

A high-resolution image of each enrolled fingerprint, stored in an encrypted container A mathematical representation of fingerprint features extracted during enrollment — biometric systems do not store images; they store mathematical models of biometric characteristics A hash of the fingerprint image, similar to how passwords are stored as hashed values An encrypted template containing the raw biometric data that can be reconstructed into the original fingerprint if needed

Question 4 of 6

A penetration tester conducts a SIM-swapping attack, convincing a carrier to transfer a target's phone number to an attacker-controlled SIM. The attacker then uses the target's stolen password to initiate a login. The authentication system sends a one-time code via SMS. The attacker receives the code and successfully authenticates. Which MFA factor was bypassed, and what stronger alternative would have prevented this?

Something you are (biometrics) was bypassed; the fix is to add a fingerprint reader to the authentication flow Something you have (SMS OTP) was bypassed via SIM swapping; a stronger alternative is a hardware token or FIDO2 security key, which is bound to the physical device and cannot be intercepted via SIM swapping Somewhere you are (location factor) was bypassed; the fix is to verify the user's GPS location before sending the SMS code Something you know (password) was bypassed; the fix is to implement a stronger password policy requiring uppercase letters and special characters

Question 5 of 6

A company uses IP address geolocation as a location-based authentication factor. A user in Chicago authenticates from an IP address that geolocates to Frankfurt. The system flags this as suspicious. What is the primary limitation of IP-based geolocation as an authentication factor, and why is it still valuable?

IP geolocation is completely unreliable and should never be used as an authentication factor because VPNs make it trivially bypassable; it has no security value IP geolocation is imprecise and can be bypassed by VPNs and proxies, making it unsuitable as a standalone authentication factor; it remains valuable as an anomaly detection signal combined with other factors, particularly for detecting impossible travel scenarios IP geolocation is perfectly accurate for user location and is suitable as a primary authentication factor; the limitation is only that it requires IPv6 to work IP geolocation only works for mobile devices, not desktop computers, because mobile IPs change constantly as users move between networks

Question 6 of 6

A biometric system has a False Acceptance Rate of 0.01% and a False Rejection Rate of 5%. What do these metrics mean, and which metric represents the greater security risk vs. usability issue?

FAR = legitimate users rejected; FRR = unauthorized users accepted. FAR is the usability issue; FRR is the security risk. FAR = unauthorized users accepted (false positive); FRR = legitimate users rejected (false negative). FAR of 0.01% is the security metric — it measures how often the system incorrectly accepts an impostor; FRR of 5% is the usability issue — it measures how often legitimate users are incorrectly rejected. FAR and FRR are the same metric measured differently; a low FAR automatically means a low FRR FAR = failed authentication rate; FRR = fraud rejection rate; both are security metrics

Matching

Match each authentication method to the correct MFA factor category.

1. A physical device the size of a USB drive that stores cryptographic keys and certificates; plugs into a USB port; authentication is phishing-resistant because it is cryptographically bound to the specific site's domain

2. The user's iris pattern captured during enrollment; converted to a mathematical model stored in the authentication system; cannot be changed if the database is compromised

3. A 6-digit numeric code generated by a smartphone application that changes every 30 seconds using a shared seed value and the current timestamp; requires access to the registered device

4. The user's GPS coordinates reported by the authenticating device; used to verify that the login originates from an expected geographic area; imprecise and can be spoofed

1. 2. 3. 4.

A. Something you have (USB security key)

B. Something you are (biometrics)

C. Something you have (software token)

D. Somewhere you are (GPS location)

Multifactor Authentication — Quiz

Matching