Study. uk . com
  1. Home
  2. All questions
  3. Question 317

CompTIA Security+ study material · question 317 of 611

A one-time password is truncated to six digits. What obligation does that place on the verifier?

  1. It must rate-limit failed authentication attempts
  2. It must extend the code's validity window
  3. It must store the code in hashed form
  4. It must require a second one-time password
Show the answer

Answer: A. It must rate-limit failed authentication attempts

Six digits is well under 64 bits, so throttling is what keeps online guessing impractical.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 3.1.4

Challenge yourself on this topic → Study as cards