Question

During a review of a company's remote access solution, an IS auditor notes that users must enter a memorized PIN and then insert a hardware smart card that generates a one-time value to log in. Management claims this constitutes strong multifactor authentication. Which conclusion should the auditor reach regarding this control?

Accepted Answer

It is genuine multifactor authentication because it combines something the user knows with something the user has.

Answer

It is not multifactor because both the PIN and the smart card are things the user possesses.

Answer

It is single-factor authentication because a PIN and a smart card verify the same knowledge factor.

Answer

It is multifactor only if a biometric is also added, since two factors are never sufficient.