nerdexam
CompTIA

PT0-001 · Question #84

After several attempts, an attacker was able to gain unauthorized access through a biometric sensor using the attacker's actual fingerprint without exploitation. Which of the following is the MOST…

The correct answer is A. The biometric device is tuned more toward false positives. The attacker accessed the system using their own unregistered fingerprint without exploitation, indicating the biometric device has a high False Acceptance Rate - it is tuned to err on the side of granting access.

Attacks and exploits

Question

After several attempts, an attacker was able to gain unauthorized access through a biometric sensor using the attacker's actual fingerprint without exploitation. Which of the following is the MOST likely explanation of what happened?

Options

  • AThe biometric device is tuned more toward false positives
  • BThe biometric device is configured more toward true negatives
  • CThe biometric device is set to fail closed
  • DThe biometnc device duplicated a valid user's fingerpnnt.

How the community answered

(33 responses)
  • A
    82% (27)
  • B
    9% (3)
  • C
    6% (2)
  • D
    3% (1)

Why each option

The attacker accessed the system using their own unregistered fingerprint without exploitation, indicating the biometric device has a high False Acceptance Rate - it is tuned to err on the side of granting access.

AThe biometric device is tuned more toward false positivesCorrect

A biometric device tuned toward false positives has a high False Acceptance Rate (FAR), meaning it accepts biometric samples that do not match any enrolled user. Because the attacker used their own real fingerprint with no exploitation, the device simply accepted an unauthorized sample - a classic false positive result caused by overly permissive sensitivity settings.

BThe biometric device is configured more toward true negatives

True negatives represent the system correctly rejecting unauthorized individuals, which is the opposite behavior of what occurred here.

CThe biometric device is set to fail closed

Fail closed means the device denies access when it encounters an error or failure condition, which would prevent unauthorized entry rather than allow it.

DThe biometnc device duplicated a valid user's fingerpnnt.

The question explicitly states the attacker used their own actual fingerprint without exploitation, ruling out any cloning or duplication of a legitimate user's biometric data.

Concept tested: Biometric false acceptance rate and sensor sensitivity tuning

Source: https://csrc.nist.gov/glossary/term/false_acceptance_rate

Topics

#biometric authentication#false positive rate#physical security#authentication bypass

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice