Study. uk . com
  1. Home
  2. All questions
  3. Question 277

CompTIA Security+ study material · question 277 of 611

A user changes the phone number that receives their authentication codes. How should the system treat this operation?

  1. As a change that may be made by support staff on request
  2. As a profile update requiring no additional verification
  3. As the binding of a new authenticator, with the corresponding controls
  4. As an account recovery event requiring re-proofing
Show the answer

Answer: C. As the binding of a new authenticator, with the corresponding controls

Treating it as a low-risk profile edit is exactly how account takeover through support channels succeeds.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 4.1.2

Challenge yourself on this topic → Study as cards