ISC2 Certified in Cybersecurity (CC)Access Controls ConceptsMedium
A user attempts to log into a system. They first enter their username, then their password, and finally, they are prompted to enter a one-time code generated by an app on their smartphone. Which authentication factor category does the smartphone app code represent?
- ASomething you do
- BSomething you have
- CSomething you know
- DSomething you are
Show answer & explanationAnswer & explanation
Correct answer: B. Something you have
The one-time code generated by a smartphone app falls under 'something you have,' as it requires possession of the physical device (the smartphone) to generate and access the code. This is a common form of multi-factor authentication.
Why the other options are wrong
- A. Something you do refers to behavioral biometrics like typing patterns or gait.
- C. Something you know refers to secrets like passwords or PINs.
- D. Something you are refers to biometric factors like fingerprints or facial recognition.
Authentication Factors
Distinct categories of credentials used to verify a user's identity during authentication.
- There are traditionally three main factors: knowledge, possession, inherence.
- Multi-factor authentication (MFA) combines two or more different factors.
- Stronger authentication uses multiple factors.
Memory trick: Know, Have, Are: the three factors to verify.