Study. uk . com
  1. Home
  2. All questions
  3. Question 485

CISSP study material · question 485 of 500

A service offers a code by voice call whenever the user's authenticator app is unavailable, with no further checks. Why does OWASP count this among authentication failures?

  1. Any fallback constitutes a second factor and so requires separate enrolment.
  2. Voice calls cannot carry a one-time code securely under any circumstances.
  3. Fallbacks are permitted only where the primary factor is phishing-resistant.
  4. A weak or ineffective fallback undermines the factor it replaces.
Show the answer

Answer: D. A weak or ineffective fallback undermines the factor it replaces.

OWASP lists allowing the use of weak or ineffective fallbacks where multi-factor authentication is not available among the conditions indicating authentication weaknesses.

Source: OWASP Top 10 A07:2025 (OWASP) — OWASP Top 10:2025 A07 Authentication Failures > Description

Challenge yourself on this topic → Study as cards