Identification, Authentication, and Authorization ECSS Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Why is Multi-Factor Authentication (MFA) considered more secure than using a single password?

   • AIt requires the attacker to compromise multiple different types of credentials
   • BIt eliminates the need for passwords entirely
   • CIt ensures the user is physically present at the computer
   • DIt makes the authentication process faster
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A bank is deploying a new online banking platform. The security team requires that customers authenticate using their password and a one-time code generated by a hardware token. The bank also wants to add a third factor by requiring a fingerprint scan on the customer's mobile device. How many distinct authentication factors will be used in total?

   • ATwo factors: possession (token) and inherence (fingerprint)
   • BTwo factors: knowledge (password) and possession (token)
   • COne factor: the hardware token
   • DThree factors: knowledge (password), possession (token), and inherence (fingerprint)
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A user logs into a system by entering the username 'jsmith' and then the correct password. After login, the system checks whether 'jsmith' has permission to access the payroll folder. Which sequence of processes is occurring?

   • AIdentification, authorization, authentication
   • BAuthorization, authentication, identification
   • CAuthentication, identification, authorization
   • DIdentification, authentication, authorization
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A government agency classifies documents as 'Confidential' or 'Top Secret'. Users are granted security clearances, and the system automatically prevents a user with a 'Confidential' clearance from reading 'Top Secret' documents. Which authorization model is being enforced?

   • AMandatory access control (MAC)
   • BRole-based access control (RBAC)
   • CDiscretionary access control (DAC)
   • DAttribute-based access control (ABAC)
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial services firm wants to strengthen remote access for its administrators. Currently, administrators log in with a username and password. The firm wants to require a second factor that is not easily phished. Which option best meets this requirement?

   • AAsk a security question such as mother's maiden name
   • BSend a one-time code via email
   • CRequire a second password chosen by the user
   • DRequire a one-time password generated by a hardware token
   Reveal Solution Discussion Select an answer first