PT0-001 · Question #84
After several attempts, an attacker was able to gain unauthorized access through a biometric sensor using the attacker's actual fingerprint without exploitation. Which of the following is the MOST…
The correct answer is A. The biometric device is tuned more toward false positives. The attacker accessed the system using their own unregistered fingerprint without exploitation, indicating the biometric device has a high False Acceptance Rate - it is tuned to err on the side of granting access.
Question
After several attempts, an attacker was able to gain unauthorized access through a biometric sensor using the attacker's actual fingerprint without exploitation. Which of the following is the MOST likely explanation of what happened?
Options
- AThe biometric device is tuned more toward false positives
- BThe biometric device is configured more toward true negatives
- CThe biometric device is set to fail closed
- DThe biometnc device duplicated a valid user's fingerpnnt.
How the community answered
(33 responses)- A82% (27)
- B9% (3)
- C6% (2)
- D3% (1)
Why each option
The attacker accessed the system using their own unregistered fingerprint without exploitation, indicating the biometric device has a high False Acceptance Rate - it is tuned to err on the side of granting access.
A biometric device tuned toward false positives has a high False Acceptance Rate (FAR), meaning it accepts biometric samples that do not match any enrolled user. Because the attacker used their own real fingerprint with no exploitation, the device simply accepted an unauthorized sample - a classic false positive result caused by overly permissive sensitivity settings.
True negatives represent the system correctly rejecting unauthorized individuals, which is the opposite behavior of what occurred here.
Fail closed means the device denies access when it encounters an error or failure condition, which would prevent unauthorized entry rather than allow it.
The question explicitly states the attacker used their own actual fingerprint without exploitation, ruling out any cloning or duplication of a legitimate user's biometric data.
Concept tested: Biometric false acceptance rate and sensor sensitivity tuning
Source: https://csrc.nist.gov/glossary/term/false_acceptance_rate
Topics
Community Discussion
No community discussion yet for this question.