Study. uk . com
  1. Home
  2. All questions
  3. Question 319

CISSP study material · question 319 of 500

A sign-up flow lets users store a password hint shown on the login page, and asks for a memorable childhood question as a recovery method. Which two rules of NIST SP 800-63B does this breach? Choose two.

  1. A hint accessible to an unauthenticated claimant must not be stored.
  2. Subscribers must not be prompted to use knowledge-based authentication or security questions.
  3. Recovery methods must always use an out-of-band device.
  4. Hints must be limited to a fixed number of characters.
Show the answer

Answer: B. Subscribers must not be prompted to use knowledge-based authentication or security questions.
A. A hint accessible to an unauthenticated claimant must not be stored.

SP 800-63B forbids storing a hint retrievable by an unauthenticated claimant, and forbids prompting subscribers to use knowledge-based authentication or security questions when choosing passwords.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards