Study. uk . com
  1. Home
  2. All questions
  3. Question 336

CISSP study material · question 336 of 500

A verifier sends a code to the subscriber's registered mobile device, which the subscriber then enters into the browser session being authenticated. Which authenticator type is this, in NIST SP 800-63B terms?

  1. An activation secret, since the code unlocks the session.
  2. A look-up secret, since the subscriber reads a value and supplies it.
  3. An out-of-band authenticator, using a channel separate from the one being authenticated.
  4. A single-factor cryptographic device, since the phone holds the secret.
Show the answer

Answer: C. An out-of-band authenticator, using a channel separate from the one being authenticated.

An out-of-band device works by sending or receiving a secret through a separate communication channel with the subscriber, distinct from the primary channel being authenticated.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.3 Out-of-Band Devices

Challenge yourself on this topic → Study as cards