Study. uk . com
  1. Home
  2. All questions
  3. Question 269

CompTIA Security+ study material · question 269 of 611

A service offers only SMS codes as its second factor. Beyond the interception risk, what NIST requirement does this miss?

  1. Codes must expire within thirty seconds
  2. An alternative authenticator type must also be available to users
  3. Codes must be at least eight digits
  4. The number must be verified annually
Show the answer

Answer: B. An alternative authenticator type must also be available to users

Telephone delivery is a restricted authenticator that may be withdrawn, and some users cannot receive it at all.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 3.1.3.3

Challenge yourself on this topic → Study as cards