Study. uk . com
  1. Home
  2. All questions
  3. Question 335

CISSP study material · question 335 of 500

A team assumes an out-of-band authenticator must meet stricter technical requirements when used at AAL2 than at AAL1. What does NIST SP 800-63B say?

  1. Requirements vary by level only for authenticators that use biometrics.
  2. Requirements tighten at every level, in proportion to the number of factors required.
  3. Each authenticator type has a separate specification per assurance level.
  4. An authenticator type's technical requirements are the same regardless of level, apart from the reauthentication rules and the phishing resistance demanded at AAL3.
Show the answer

Answer: D. An authenticator type's technical requirements are the same regardless of level, apart from the reauthentication rules and the phishing resistance demanded at AAL3.

Apart from the reauthentication rules and the phishing resistance demanded at AAL3, an authenticator type's technical requirements are identical at every assurance level.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3. Authenticator Requirements

Challenge yourself on this topic → Study as cards