Identifying Multifactor Authentication in Online Banking
Short answer
A Using a password (knowledge) and a smartphone code (possession) constitutes multifactor authentication.
Question
Which type of authentication does this situation describe?
Key Takeaways
The question tests the ability to distinguish between single-factor and multifactor authentication by identifying two distinct types of evidence: knowledge (password) and possession (smartphone code).
This question tests the definition of authentication factors by describing a scenario where a password and a one-time code are used together, establishing that this constitutes multifactor authentication.
Common mistake: Candidates often confuse AAA or RADIUS with the authentication method itself; these are protocols or frameworks for managing access, not the specific combination of user credentials described.
Expert Analysis
Why the Answer Is Correct
Multifactor authentication (MFA) requires the use of at least two different categories of verification factors from the available groups: something you know, something you have, and something you are. In this scenario, the strong password represents 'something you know' (knowledge factor), while the 5-digit code sent to the smartphone represents 'something you have' (possession factor). The combination of these two distinct factors confirms that the authentication method is multifactor.
Why the Other Options Are Wrong
AAA (Authentication, Authorization, and Accounting) is a framework for controlling access to computer resources, not the specific user-side mechanism described. RADIUS is a networking protocol that provides centralized Authentication, Authorization, and Accounting management, which may support MFA but is not the term for the user experience itself. VPN (Virtual Private Network) is a technology for creating secure connections over a public network; while it uses authentication, the term does not describe the multi-step verification process of entering a password and a code.
Community Comment Notes
Community feedback correctly identifies that the scenario involves combining a known secret with a physical device token. As Roattana noted, "Multifactor Authentication (MFA) requires a user to provide two or more verification factors," specifically highlighting the password as knowledge and the code as possession. This consensus aligns with standard security principles defining MFA.
Exam Strategy
When analyzing authentication scenarios, always categorize each credential into one of the three buckets: Knowledge, Possession, or Inherence. If the scenario lists items from two or more different buckets, the answer is almost certainly Multifactor Authentication.
Frequently Asked Questions
Why isn't this considered single sign-on?
Is the 5-digit code considered biometric?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Roattana 👍 1 Answered A• Multifactor Authentication (MFA) requires a user to provide two or more verification factors to gain access. • In this scenario, you use something you know (your password) combined with something you have (the 5-digit code sent to your smartphone).
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.