Study. uk . com
  1. Home
  2. All questions
  3. Question 43

CISSP study material · question 43 of 500

A contractor is choosing authenticators for a system that must operate at Authentication Assurance Level 3 (AAL3) under NIST SP 800-63B-4. The security architect proposes passkeys synchronised across each staff member's phone and laptop through a cloud account. Why does this proposal fail the AAL3 requirement?

  1. The passkey lives on a general-purpose device, and AAL3 requires a dedicated single-purpose hardware token.
  2. The private key must be exportable in order to synchronise, and AAL3 requires a key that cannot leave its authenticator.
  3. The passkey counts as a single factor, and AAL3 is the first level at which two distinct factors are demanded.
  4. The passkey is not phishing-resistant, and AAL3 requires an authenticator that resists phishing.
Show the answer

Answer: B. The private key must be exportable in order to synchronise, and AAL3 requires a key that cannot leave its authenticator.

Syncing requires exporting the private key, so syncable authenticators are excluded from AAL3. Passkeys are phishing-resistant, so option d misidentifies the failing requirement.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > AAL3 > Authenticator Requirements

Challenge yourself on this topic → Study as cards