Exam CISSP topic 1 question 301 discussion

Its only D that makes the authentication 2 factor. Password is what you know and hardware token is what you have. The selected answer is still "what you know"

Username/Password = Something you know A = Somewhere your are, (Misc type not part of MFA) B = Something you know (Knowledge factor) C = Something you know (Knowledge factor) D = Something you have(Possession factor) MFA = Something you know + Something you have

D. Enter an automatically generated number from a hardware token

Multi-factor authentication (MFA) typically requires at least two of the following factors: Something you know (e.g., password or PIN) Something you have (e.g., a hardware token or smart card) Something you are (e.g., biometric verification like a fingerprint or facial recognition) In the given scenario, the application already has "something you know" with the username and password. To implement MFA, another factor from a different category should be added. An automatically generated number from a hardware token falls under the "something you have" category, making it a suitable choice for MFA. The other options provided are variations of "something you know," which wouldn't truly implement multi-factor authentication when combined with just a username and password.

C. Many times I have used websites where after the username and password you enter your answer to a secret question. The hardware token with changing numbers is used at work, but this is for a customer facing website, customers are using it. So C is the only option. D would be correct for employees.

So everyone saying D. Question. So a Customer facing bank application, will need to provide a hardware token to 1000's of their customers? LOL

The correct answer is C. Use of separation for the voice network. Explanation: A major consideration when implementing a Voice over Internet Protocol (VoIP) network is ensuring the separation of voice traffic from regular data traffic. This can be achieved through the use of virtual local area networks (VLANs) or separate physical networks. Separating voice traffic helps to maintain the quality of service, reduce latency, and mitigate potential security risks.

The correct answer is D. Enter an automatically generated number from a hardware token. Explanation: Multi-factor authentication (MFA) requires at least two different factors from separate categories to verify the user's identity. These categories are typically something the user knows (e.g., password), something the user has (e.g., hardware token), and something the user is (e.g., biometrics).

Why C not D?

answer a secret question is same factor of something you know (password). So answer C is 100% wrong. I vote for D.

The answer is C. Somebody can use a hardware token by stealing it (not D), for example. But a secret question, nobody can steal it unless you reveal it. The knowledge factor is the best and more secure.

I am now convinced that none of these answers are actually vetted. So grateful for the comments. And my answer is D, something you have.

D is the better answer because the hardware token would be considered "something the user has" to supplement the username and password the application requires.

I also agree with D. But, A can also be correct as geolocate (somewhere you are) can also enable MFA, just a thought.

It should be D

Answer is D. Multifactor authentication - Username and password (something you know) and a hardware token (something you have). All other options are incorrect.

The answer D appears to be the only choice - Something you have -