A user logs into a web application using a password and a TOTP code. After login, the application displays a dashboard but the user cannot access the admin panel. The user's account is listed as an administrator in the application's user database. What is the most likely explanation?

The TOTP code was incorrect, but the system still allowed login.

The password was correct but the TOTP secret was reset.

The user's session is not associated with the admin role because the authorization check failed.

The admin panel requires a separate authentication factor.

A company is deploying a centralized directory service to manage user accounts and enforce access policies across multiple Linux servers. The solution must support LDAP-based authentication and allow administrators to define group-based permissions. Which technology should they choose?

A local /etc/passwd file on each server

OpenLDAP with group objects and POSIX attributes

A RADIUS server for network access only

A certificate authority (CA) for issuing certificates

A security auditor recommends implementing multi-factor authentication (MFA) for all administrative accounts. The administrator currently uses a password and a one-time passcode from a mobile app. Which of the following would further strengthen the authentication process?

Changing the one-time passcode app

Adding a biometric scan such as a fingerprint

A company is deploying MFA for a remote workforce. The security team wants phishing-resistant authentication, but the help desk is concerned about the cost of issuing hardware tokens to 5,000 employees. The company already issues company-managed laptops and smartphones. Which approach best balances security and cost?

Deploy FIDO2 passkeys on the company-managed devices.

Issue hardware tokens to all employees.

Use a TOTP app on personal smartphones.

Use SMS one-time passcodes to the employee's personal phone.

EC-CouncilNetwork Defense Essentials

Domain 1Objective 5

Authentication Mechanisms and Authorization Systems NDE Practice Questions (Page 8)

Part of the Network Security Fundamentals and Access Control domain, which makes up ~14% of our current practice bank.

47questions here

10free pages

7concepts

Questions 36–40

36application · medium
A user logs into a web application using a password and a TOTP code. After login, the application displays a dashboard but the user cannot access the admin panel. The user's account is listed as an administrator in the application's user database. What is the most likely explanation?
Select an answer first
37application · medium
A company is deploying a centralized directory service to manage user accounts and enforce access policies across multiple Linux servers. The solution must support LDAP-based authentication and allow administrators to define group-based permissions. Which technology should they choose?
Select an answer first
38application · medium
A security auditor recommends implementing multi-factor authentication (MFA) for all administrative accounts. The administrator currently uses a password and a one-time passcode from a mobile app. Which of the following would further strengthen the authentication process?
Select an answer first
39expert · hard
A company is deploying MFA for a remote workforce. The security team wants phishing-resistant authentication, but the help desk is concerned about the cost of issuing hardware tokens to 5,000 employees. The company already issues company-managed laptops and smartphones. Which approach best balances security and cost?
Select an answer first
40foundation · easy
Which authentication mechanism relies on a physical device that generates a time-based one-time password (TOTP)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Authentication Mechanisms and Authorization Systems NDE Practice Questions (Page 8)

Questions 36–40

A user logs into a web application using a password and a TOTP code. After login, the application displays a dashboard but the user cannot access the admin panel. The user's account is listed as an administrator in the application's user database. What is the most likely explanation?

A company is deploying a centralized directory service to manage user accounts and enforce access policies across multiple Linux servers. The solution must support LDAP-based authentication and allow administrators to define group-based permissions. Which technology should they choose?

A security auditor recommends implementing multi-factor authentication (MFA) for all administrative accounts. The administrator currently uses a password and a one-time passcode from a mobile app. Which of the following would further strengthen the authentication process?

Which authentication mechanism relies on a physical device that generates a time-based one-time password (TOTP)?

Keep studying — Network Security Fundamentals and Access Control