Authentication and Password Security

Which statement best distinguishes identification from authentication?

• Identification proves the asserted identity

• Authentication selects the authorization level

• Identification asserts who a person is

• Authentication asserts who a person is

Which is NOT one of the classic authentication factors?

• Something the user has

• Something the user knows

• Something the user is

• Something the user does

What does multifactor authentication require?

• Two or more different authentication methods

• One strong password with special characters

• Biometrics combined with authorization rules

• Encryption of stored password databases

An attacker tries every possible password using automation. Which attack is described?

• Replay injection

• Dictionary poisoning

• Phishing campaign

• Brute force attack

If a password uses upper and lower case letters only and is 8 characters long, about how many combinations exist?

Which change most effectively increases resistance to brute force guessing?

• Remove numbers to reduce complexity

• Increase character set and length together

• Avoid special characters for compatibility

• Use only lowercase to simplify entry

Which metric measures the percentage of times authorized users are wrongly denied by a biometric system?

• False reject rate percentage

• False accept rate percentage

• Crossover error rate value

• User acceptance rating

What does the false accept rate represent in biometric access control?

• Level of user satisfaction

• Point where two errors equal

• Authorized users denied access

• Unauthorized users allowed access

At the crossover error rate, what condition holds true for system errors?

• False acceptances exceed true matches

• True matches equal false rejections

• False rejections exceed true matches

• False rejections equal false acceptances

A security team tightens thresholds to minimize false acceptances. Which trade-off is most likely?

• Higher false reject rate

• Lower false reject rate

• Unchanged error rates

• Improved user acceptance