When implementing authentication, which of the following is considered a best practice?

The current industry best practice for authentication is Multi-Factor Authentication (MFA). MFA strengthens access control by requiring a user to present two or more independent pieces of evidence (called factors) to an authentication mechanism. This layered defense makes it significantly more difficult for an unauthorized person to gain access. The factors are categorized as something you know (e.g., password, PIN), something you have (e.g., security token, smartphone app), and something you are (e.g., fingerprint, facial scan). Option D correctly encapsulates this principle by recommending the use of "two or more authentication methods" and providing valid examples.

A. A username is an identifier, not an authentication factor. This option describes single-factor authentication (password only), which is not a best practice.

B. This option incorrectly classifies a username as an authentication method. While it describes two-factor authentication, option D is a more accurate and general statement of the best practice.

C. Using only one method, known as single-factor authentication, is considered a weak security posture and is vulnerable to common attacks like password guessing or phishing.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63B: Digital Identity Guidelines: Authentication and Lifecycle Management.

Section 5.1.1

"MFA": "When MFA is used for authentication

the verifier SHALL require at least two independent authentication factors... Using multiple authenticators that are all of the same factor (e.g.

a password and a PIN

both of which are something you know) is not MFA." This directly supports the principle of using two or more distinct factors as a best practice.

2. Stanford University IT. (n.d.). Two-Step Authentication.

Overview Section: "Two-step authentication adds a second layer of security to your online accounts. Verifying your identity using a second factor (like your phone or other mobile device) prevents anyone but you from logging in

even if they know your password." This resource from a reputable university endorses the use of a second factor as a critical security practice.

3. OWASP Foundation. (n.d.). Authentication Cheat Sheet.

Section "Multi-Factor Authentication": "Multi-factor authentication (MFA) should be implemented on all internet-facing applications that handle sensitive data... MFA is a method of confirming a user's claimed identity in which a user is granted access only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism." This reinforces MFA as a standard for securing applications.