CompTIA SecurityX (CAS-005)Security ArchitectureHard
A security architect is designing an authentication system for a highly sensitive government application. The system requires multiple independent factors for user authentication and must be resistant to credential theft and replay attacks. Which of the following authentication methods, when combined, BEST meets these requirements for a robust, multi-factor authentication (MFA) system?
- AClient Certificate + Smart Card
- BPassword + Knowledge-based authentication (KBA)
- CPassword + SMS OTP
- DBiometric (fingerprint) + Security Key (FIDO2)
Show answer & explanationAnswer & explanation
Correct answer: D. Biometric (fingerprint) + Security Key (FIDO2)
Biometric authentication (something you are) combined with a FIDO2 security key (something you have) provides strong, phishing-resistant, and replay-resistant MFA. FIDO2 specifically uses public-key cryptography to prevent replay attacks and is highly secure against credential theft.
Why the other options are wrong
- A. While client certificates and smart cards are strong factors ('something you have'), combining them typically results in two factors of the same type, not distinct factors, and might not be as widely deployable or user-friendly as FIDO2 for some scenarios, although still robust.
- B. Knowledge-based authentication (KBA) relies on 'something you know' (like a password) and is often susceptible to social engineering or public data breaches, offering weak security as a second factor.
- C. SMS OTP is vulnerable to SIM-swapping and phishing attacks, making it less robust for highly sensitive applications.
FIDO2 Authentication
FIDO2 is an open authentication standard that uses public-key cryptography to provide strong, phishing-resistant, and passwordless or second-factor authentication. It typically involves a FIDO authenticator (e.g., security key, biometric sensor) and a web browser or application.
- Uses public-key cryptography for strong security.
- Phishing-resistant by design.
- Prevents replay attacks.
- Supports passwordless and second-factor authentication.
- Improves user experience and security simultaneously.
Memory trick: For top secrets, prove who you are with your body and your special key.