1. Home
2. All questions
3. Question 482

CISSP study material · question 482 of 500

A forgot-password flow asks the user for their mother's maiden name. What does OWASP's 2025 authentication entry say about such mechanisms?

• Software security

1. They are acceptable where the user selects the question themselves.
2. They are acceptable where the answer is stored hashed rather than in clear text.
3. Knowledge-based answers cannot be made safe, so recovery should not rest on them.
4. They are acceptable as a second factor but not as a first.

Challenge yourself on this topic → Study as cards