A new corporate policy requires all staff to use multifactor authentication to access company resources. Which of the following can be utilized to set up this form of identity and access management?…

Question

Options

• AAuthentication tokens
• BLeast privilege
• CBiometrics
• DLDAP
• EPassword vaulting
• FSAML

• A
  89% (32)
• B
  6% (2)
• E
  3% (1)
• F
  3% (1)

Explanation

Authentication tokens (A) and biometrics (C) are both valid MFA factors because MFA requires combining two or more of the three authentication categories: something you know (password/PIN), something you have (token/smart card), and something you are (biometric). Tokens satisfy "something you have" by generating time-based one-time codes, while biometrics satisfy "something you are" through fingerprints, facial recognition, or retina scans - together they fulfill the multi-factor requirement.

The distractors fail because:

• B (Least privilege) is an authorization principle limiting access scope, not an authentication mechanism.
• D (LDAP) is a directory service protocol for looking up and authenticating users against a directory - it's a single-factor authentication backend, not an MFA factor.
• E (Password vaulting) manages and stores passwords but is itself a single-factor tool ("something you know"), not MFA.
• F (SAML) is a federated SSO/identity assertion protocol - it can carry MFA assertions between systems but is not itself an MFA factor.

Memory tip: Use the "know / have / are" framework. Scan the answer choices for items that map to one of those three categories - tokens = have, biometrics = are. Anything that's a protocol, principle, or storage mechanism won't fit.

No community discussion yet for this question.