Which of the following is used to generate passcodes necessary to access applications or systems that require an extra layer of security?

An authenticator application is a software component used to implement two-factor authentication (2FA) or multi-factor authentication (MFA). It generates a time-based one-time passcode (TOTP) that a user must provide along with their password to access a system or application. This provides an additional layer of security by requiring the user to possess a specific device (e.g., a smartphone) running the application, which corresponds to the "something you have" authentication factor. The generated passcodes are temporary and change frequently, typically every 30-60 seconds, enhancing security.

B. Access control lists: These are rule sets that define permissions for users or groups on a resource; they control authorization, not passcode generation for authentication.

C. Biometrics: This method uses unique physical characteristics (e.g., fingerprint, face) for authentication ("something you are"), not for generating a passcode to be entered.

D. Smart card readers: These devices read data from a physical smart card, which typically contains a digital certificate for authentication, rather than generating a user-facing passcode.

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63B: Digital Identity Guidelines

Authentication and Lifecycle Management.

Section 5.1.4

"One-Time Passwords (OTPs)": This section details the use of OTPs generated by an authenticator

stating

"OTPs can be generated on a device such as a hardware token or a software application on a mobile phone... The verifier SHALL ensure that the authenticator and the claimant’s device that generates the OTP... are separate devices." This directly supports the function of an authenticator application.

DOI: https://doi.org/10.6028/NIST.SP.800-63b

2. Microsoft. (2023). How to use the Microsoft Authenticator app. Microsoft Learn.

Section "Respond to a sign-in prompt": The documentation explains

"The Microsoft Authenticator app can be used as a software token to generate an OATH time-based one-time password (TOTP) code. You can use the Authenticator app to generate a code that can be entered on any sign-in page that supports these codes." This is an official vendor document describing the exact function in the question.

3. CompTIA. (2021). CompTIA A+ Core 2 (220-1102) Exam Objectives.

Objective 2.6

"Given a scenario

secure a SOHO network": This objective explicitly lists "MFA (Multi-factor authentication)" as a key security concept

establishing the relevance of authenticator applications to the exam curriculum.