Question Q-5974 What are the three authentication factors?
2 comments · last active May 23, 2026
CompTIA Security+ - Identity and Access Management
By Jordan Blake · Updated Jul 10, 2026
| Questions | 23 |
| Passing Score | 75% |
| Format | 48% Multiple Choice |
| Sessions Logged | 1,661 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Topics covered
Uncategorized23 questions
Discussion
Log in to post a comment, reply, or expand a question.
Account lifecycle: provision → review → modify → deprovision. Orphan accounts = ex-employee still active — huge audit finding.
Joiner/mover/leaver automation via HR feed into IAM tool is the 'right' enterprise answer.
Biometrics: false accept vs false reject rates. Multimodal reduces errors but raises privacy issues.
Something you are = inherence factor. Liveness detection fights photo spoofing.
PAP sends creds in cleartext — never use. PEAP/EAP-TLS for enterprise Wi-Fi; certificate-based is strongest.
802.1X is port-based NAC — supplicant on client, authenticator on AP/switch, RADIUS backend.
Privileged access management (PAM): vault admin creds, session record, just-in-time elevation. Break-glass accounts monitored.
Separation of duties: no one person can approve + pay invoice. Different from least privilege but related.
Kerberos: ticket-granting ticket, mutual auth, time sync critical. NTLM is legacy and weaker — know when labs still break.
LDAP directory vs Active Directory — AD extends LDAP for Windows domains. Sec+ loves 'which protocol/port'.
RBAC = job function permissions. ABAC = attributes (dept, clearance, device health). ABAC scales but complex.
Least privilege applies to both — default deny, grant minimum needed.
Federation: trust between orgs/IdPs. SAML assertions vs OIDC JWTs — know which is XML-heavy vs JSON/API era.
+2 votesIdP authenticates; SP consumes assertion. User doesn't get a password on every SaaS app.
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
?? Multiple Choice (Hard)
Which attack exploits the implicit trust in Single Sign-On by stealing a valid authentication token?
Explanation
In Active Directory environments using Kerberos, a Golden Ticket attack forges Kerberos TGTs using the KRBTGT account hash (extracted from a Domain Controller). With a Golden Ticket, attackers can impersonate any user with any privileges for up to 10 years. Mitigation: regularly rotate KRBTGT password, monitor for unusual Kerberos tickets.
Question 2
?? Multiple Choice (Medium)
What is federation in the context of identity management?
Explanation
Identity federation allows users to use credentials from one organization (identity provider) to access resources in another organization (service provider/relying party). Protocols: SAML 2.0 (enterprise federation), OpenID Connect (consumer), WS-Federation. Example: using your university credentials to access a partner organization's resources.
Question 3
?? True/False (Medium)
Time-based One-Time Passwords (TOTP) rely on a shared secret and the current time to generate authentication codes valid for about 30 seconds.
Explanation
TOTP (RFC 6238) generates a 6-digit code based on: shared secret + current Unix time (rounded to 30-second window). Both client app (Google Authenticator, Authy) and server compute the same code independently. Codes expire every 30 seconds. TOTP is a "something you have" factor (authenticator app on phone).
Question 4
?? Fill in the Blank (Easy)
The principle of [[blank1]] access ensures that users are only granted the minimum permissions necessary to perform their job functions.
Explanation
Least privilege (also called minimum necessary access) is a core security principle. Users, processes, and systems should have only the permissions required for their specific tasks. This limits the damage from compromised accounts, insider threats, and malware. Combined with need-to-know (access to information required for job), it minimizes attack surface.
Question 5
?? True/False (Hard)
Separation of duties requires that no single individual has complete control over any critical process or transaction.
Explanation
Separation of duties (SoD) prevents fraud and errors by dividing critical tasks among multiple people. Example: the person who creates vendor accounts cannot also process payments. In IT: developers cannot deploy directly to production; no single admin has both backup and restore rights. This limits insider threat risk and enforces accountability.
Identification vs authentication vs authorization — three different steps. Login is authn; file access is authz.
Accountability = auditing who did what after auth. Non-repudiation ties to logging + identity proof.