ExamTopics Logo
Mail Us[email protected]
Menu
Comptia Discussions
exam questions

Exam CAS-003 All Questions

View all questions & answers for the CAS-003 exam
Go to Exam

Exam CAS-003 topic 1 question 40 discussion

Actual exam question from CompTIA's CAS-003
Question #: 40
Topic #: 1
[All CAS-003 Questions]

An insurance company has two million customers and is researching the top transactions on its customer portal. It identifies that the top transaction is currently password reset. Due to users not remembering their secret questions, a large number of calls are consequently routed to the contact center for manual password resets. The business wants to develop a mobile application to improve customer engagement in the future, continue with a single factor of authentication, minimize management overhead of the solution, remove passwords, and eliminate to the contact center. Which of the following techniques would BEST meet the requirements? (Choose two.)

  • A. Magic link sent to an email address
  • B. Customer ID sent via push notification
  • C. SMS with OTP sent to a mobile number
  • D. Third-party social login
  • E. Certificate sent to be installed on a device
  • F. Hardware tokens sent to customers
Show Suggested Answer Hide Answer
Suggested Answer: CE 🗳️
by Rankin at Oct. 30, 2020, 11:48 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
SoukelezArtibuz
Highly Voted 4 years, 7 months ago
A C are solution that actually exist in the wild.
upvoted 10 times
...
cvMikazuki
Most Recent 3 years, 8 months ago
A and D. A - https://www.okta.com/blog/2020/09/magic-links/ D - we are using google,meta, other socmed to login to mobile application for a while now 2million users, not possible to issue certificate due sheer number of users. OTP is part of 2FA.
upvoted 3 times
...
theguru
3 years, 8 months ago
I am curious; for those saying C, is that not part of a 2FA? the question clearly states that the company wants to continue with a "single factor authentication". I will go with A & D
upvoted 1 times
tirajvid
1 year, 5 months ago
Then emailing reset link can be also considered as 2FA .. isnt it ?
upvoted 1 times
...
...
CragShield
4 years, 5 months ago
I understand C, but why NOT E?
upvoted 1 times
boblee
4 years, 4 months ago
because it makes no sense.
upvoted 1 times
...
Trap_D0_r
4 years, 4 months ago
Installing client certs on your computer is a lot like accepting cookies--security conscious people won't want to install a dozen certs on their machines. Plus the certs would have to be tied to the device, that means you'll need one for your phone and one for each computer or other mobile device. Also, what's the expiration date on these certs? How do you prevent access if a cert is stolen and an ID spoofed? Are you issuing a new cert every week? Every month? A&C are single-use ephemeral access solutions that use customer-provided contact information to ensure account security. It's neither practical nor plausible to run a certificate tree and start issuing out a million certs to a million customers.
upvoted 1 times
...
...
TheSkyMan
4 years, 5 months ago
Agree with A & C being the answer. https://www.loginradius.com/blog/start-with-identity/2020/10/loginradius-launches-passwordless-login-with-magic-link-or-otp/
upvoted 2 times
...
Rankin
4 years, 8 months ago
Answer is AD
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel