Identifying Multifactor Authentication in Online Banking
In order to do online banking, you enter a strong password and then enter the 5-digit code sent to you on your smartphone. Which type of authentication does this situation describe?
Community Insight
The question tests the ability to distinguish between single-factor and multifactor authentication by identifying two distinct types of evidence: knowledge (password) and possession (smartphone code).
This question tests the definition of authentication factors by describing a scenario where a password and a one-time code are used together, establishing that this constitutes multifactor authentication.
Candidates often confuse AAA or RADIUS with the authentication method itself; these are protocols or frameworks for managing access, not the specific combination of user credentials described.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Multifactor authentication (MFA) requires the use of at least two different categories of verification factors from the available groups: something you know, something you have, and something you are. In this scenario, the strong password represents 'something you know' (knowledge factor), while the 5-digit code sent to the smartphone represents 'something you have' (possession factor). The combination of these two distinct factors confirms that the authentication method is multifactor.Why the Other Options Are Wrong
AAA (Authentication, Authorization, and Accounting) is a framework for controlling access to computer resources, not the specific user-side mechanism described. RADIUS is a networking protocol that provides centralized Authentication, Authorization, and Accounting management, which may support MFA but is not the term for the user experience itself. VPN (Virtual Private Network) is a technology for creating secure connections over a public network; while it uses authentication, the term does not describe the multi-step verification process of entering a password and a code.Community Comment Notes
Community feedback correctly identifies that the scenario involves combining a known secret with a physical device token. As Roattana noted, "Multifactor Authentication (MFA) requires a user to provide two or more verification factors," specifically highlighting the password as knowledge and the code as possession. This consensus aligns with standard security principles defining MFA.Exam Strategy
When analyzing authentication scenarios, always categorize each credential into one of the three buckets: Knowledge, Possession, or Inherence. If the scenario lists items from two or more different buckets, the answer is almost certainly Multifactor Authentication.
Frequently Asked Questions
Why isn't this considered single sign-on?
Single sign-on allows access to multiple systems with one set of credentials. Here, the user must provide two distinct types of evidence to verify identity, which defines multifactor authentication.
Is the 5-digit code considered biometric?
No, biometrics involve physiological traits like fingerprints or facial recognition. A code sent to a phone is a possession factor because it relies on having access to the physical device.