Which two security approaches help build a strong authentication scheme? (Choose two.)

Question

Options

• Aconnection based on location
• Bsession IDs accepted only from cookies
• Cmaximum allowed connections
• Duser logout
• Esession logout because of inactivity

• A
  3% (1)
• B
  13% (4)
• C
  77% (24)
• D
  6% (2)

Explanation

Limiting maximum allowed connections (C) directly strengthens authentication by blocking brute-force and credential-stuffing attacks - without a cap, attackers can hammer a login endpoint indefinitely. Session logout due to inactivity (E) is a core defense because abandoned sessions are prime targets for hijacking; an automatic timeout shrinks that attack window regardless of user behavior.

Why the distractors are wrong:

• A (location-based): Geolocation can be a supplemental signal but is trivially bypassed with VPNs and proxies - it's not a foundational authentication control.
• B (session IDs only from cookies): Good hygiene, but it's a session transport rule, not an authentication scheme strengthener - it prevents session IDs from leaking in URLs but doesn't reinforce the auth process itself.
• D (user logout): Relies entirely on user action; it's a best practice but provides no systemic protection since users frequently forget or skip it.

Memory tip: Think "C-E = Control + Expire" - you Control abuse with connection limits and Expire stale sessions automatically. Both are enforced server-side without depending on the user to do the right thing, which is the hallmark of a strong authentication scheme.

No community discussion yet for this question.