CISSP-ISSAP · Question #204
You work as a technician for Trade Well Inc. The company is in the business of share trading. To enhance security, the company wants users to provide a third key (apart from ID and password) to…
The correct answer is B. Key fobs. Key fobs generate time-based one-time passwords (TOTP) - a rotating numeric code the user physically possesses - making them the ideal "third key" on top of an existing ID and password. The word "key" in the product name is a direct clue: a key fob literally provides a third…
Question
You work as a technician for Trade Well Inc. The company is in the business of share trading. To enhance security, the company wants users to provide a third key (apart from ID and password) to access the company's Web site. Which of the following technologies will you implement to accomplish the task?
Options
- ASmart cards
- BKey fobs
- CVPN
- DBiometrics
How the community answered
(17 responses)- B82% (14)
- C12% (2)
- D6% (1)
Explanation
Key fobs generate time-based one-time passwords (TOTP) - a rotating numeric code the user physically possesses - making them the ideal "third key" on top of an existing ID and password. The word "key" in the product name is a direct clue: a key fob literally provides a third key for authentication.
Why the others are wrong:
- A. Smart cards - valid authentication hardware, but they typically replace a password rather than supplement it, and require card readers installed at every workstation, making web-based deployment impractical.
- C. VPN - a network tunneling protocol for securing data in transit, not an authentication factor; it doesn't provide a credential the user presents.
- D. Biometrics - a legitimate third factor ("something you are"), but requires specialized scanners at every access point, making it far less practical for web site login than a key fob, which only needs a user to type a code.
Memory tip: The phrase "third key" in the question is your hint - a key fob literally has "key" in its name and physically resembles a key chain device. If an exam question mentions a "token," "fob," or numeric code that changes every 30–60 seconds, that's always a key fob scenario.
Topics
Community Discussion
No community discussion yet for this question.