Study. uk . com
  1. Home
  2. All questions
  3. Question 332

CISSP study material · question 332 of 500

An AAL2 session has passed its inactivity timeout but not its overall timeout. What lighter reauthentication does NIST SP 800-63B permit?

  1. A one-time password from the enrolled device alone.
  2. A full reauthentication using both factors, with no concession available.
  3. A successful password or biometric comparison together with the session secret.
  4. Presentation of the session secret alone.
Show the answer

Answer: C. A successful password or biometric comparison together with the session secret.

At AAL2, where the inactivity timeout has passed but the overall timeout has not, the verifier may allow reauthentication using only a password or biometric comparison alongside the session secret.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 2.2 Authentication Assurance Level 2

Challenge yourself on this topic → Study as cards