nerdexam
(ISC)2

CISSP-ISSAP · Question #204

You work as a technician for Trade Well Inc. The company is in the business of share trading. To enhance security, the company wants users to provide a third key (apart from ID and password) to…

The correct answer is B. Key fobs. Key fobs generate time-based one-time passwords (TOTP) - a rotating numeric code the user physically possesses - making them the ideal "third key" on top of an existing ID and password. The word "key" in the product name is a direct clue: a key fob literally provides a third…

Identity and Access Management (IAM) Architecture

Question

You work as a technician for Trade Well Inc. The company is in the business of share trading. To enhance security, the company wants users to provide a third key (apart from ID and password) to access the company's Web site. Which of the following technologies will you implement to accomplish the task?

Options

  • ASmart cards
  • BKey fobs
  • CVPN
  • DBiometrics

How the community answered

(17 responses)
  • B
    82% (14)
  • C
    12% (2)
  • D
    6% (1)

Explanation

Key fobs generate time-based one-time passwords (TOTP) - a rotating numeric code the user physically possesses - making them the ideal "third key" on top of an existing ID and password. The word "key" in the product name is a direct clue: a key fob literally provides a third key for authentication.

Why the others are wrong:

  • A. Smart cards - valid authentication hardware, but they typically replace a password rather than supplement it, and require card readers installed at every workstation, making web-based deployment impractical.
  • C. VPN - a network tunneling protocol for securing data in transit, not an authentication factor; it doesn't provide a credential the user presents.
  • D. Biometrics - a legitimate third factor ("something you are"), but requires specialized scanners at every access point, making it far less practical for web site login than a key fob, which only needs a user to type a code.

Memory tip: The phrase "third key" in the question is your hint - a key fob literally has "key" in its name and physically resembles a key chain device. If an exam question mentions a "token," "fob," or numeric code that changes every 30–60 seconds, that's always a key fob scenario.

Topics

#Multi-factor authentication#Key fob#Authentication factor#Access control

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSAP Practice