Remote payroll clerks at a retail chain sign in with a password and then type a six-digit code from an authenticator app on a phone they carry. Which control does that second step add?
Select an answer to reveal the explanation.
Short Explanation
You have a password, which is something you know, and a code from the phone you carry, which is something you have. That combination gives you multifactor authentication because it uses two different kinds of proof. Although you type the code, it proves possession of the phone rather than serving as another password.
Full Explanation
Multifactor authentication uses evidence from at least two different categories. Here, the password is something the clerk knows, while the rotating six-digit code is generated on a phone the clerk carries; providing the current code shows possession of that device. The code is not a second knowledge factor simply because the clerk types it: its role is to prove that the phone is present. Single sign-on lets one authentication open several applications, but the described second step adds a factor rather than reusing a payroll password across applications. Role-based access limits what an authenticated clerk may do, such as access payroll but not administer the network; it does not verify identity with the phone code. Exam caveat: two pieces of evidence from the same category, such as two knowledge factors, do not constitute multifactor authentication. Practical check: review a sign-in event to confirm it records both a knowledge factor and a possession factor, and verify that knowing the password alone does not let a clerk complete sign-in without the current code.