Study. uk . com
  1. Home
  2. All questions
  3. Question 44

CISSP study material · question 44 of 500

A credential service provider proofs applicants remotely at Identity Assurance Level 2 (IAL2), collecting one fair and one strong piece of evidence. A government customer now requires Identity Assurance Level 3 (IAL3), and the provider's analyst assumes the gap is stronger documents. Under NIST SP 800-63A-4, what actually distinguishes IAL3 proofing?

  1. The evidence must be validated against the issuing authority rather than against a commercial data source.
  2. The applicant must present two superior pieces of evidence rather than one fair and one strong piece.
  3. The applicant must be bound to a hardware authenticator before any evidence collection may begin.
  4. The session must be attended on-site by a proofing agent and a biometric sample must be collected and retained.
Show the answer

Answer: D. The session must be attended on-site by a proofing agent and a biometric sample must be collected and retained.

Evidence requirements are identical at IAL2 and IAL3; the lift comes from on-site attended proofing plus a retained biometric, not from demanding superior documents.

Source: NIST SP 800-63A Rev. 4 (NIST) — SP 800-63A-4 > Identity Assurance Level 3 > Proofing Types / Evidence Collection / Attribute Requirements

Challenge yourself on this topic → Study as cards