Which of the following security controls would provide the most efficient and effective authentication for customers to access these online shopping…

Two-level (or multi-factor) authentication (MFA) is the most efficient and effective security control

for authenticating customers when accessing online shopping accounts. It provides an extra layer of

security beyond just passwords, making it more difficult for unauthorized users to gain access.

Why Two-Level Sign-On (MFA) Is the Best Choice?

Stronger Authentication – It requires two independent verification methods, such as:

Something you know (password, PIN)

Something you have (one-time code, mobile device, smart card)

Something you are (biometric feature)

Reduces Risk of Credential Theft – Even if hackers obtain a user's password, they still need the

second factor to gain access.

Meets Regulatory Standards – Many cybersecurity frameworks (NIST, ISO 27001, PCI-DSS)

recommend or mandate MFA for customer authentication.

Enhanced Customer Trust – Provides users with better security, reducing risks of fraud or account

takeovers.

Why Not the Other Options?

A . 12-digit password feature – Longer passwords improve security, but they can still be

compromised through phishing or brute force attacks.

B . Security question feature – These are often weak because users choose predictable answers (e.g.,

mother's maiden name).

C . Voice recognition feature – Biometric authentication is useful, but voice recognition can be

bypassed using deepfake or recorded audio.

IIA Reference:

IIA’s GTAG (Global Technology Audit Guide) on Information Security Management – Recommends

multi-factor authentication for access control.

IIA’s International Professional Practices Framework (IPPF) – Standard 2110.A2 – Highlights the need

for strong security controls to protect customer data.

NIST SP 800-63 (Digital Identity Guidelines) – Encourages multi-factor authentication as a best

practice for securing user accounts.

✅ Final Answe r: D. Two-level sign-on feature (Most effective for online customer

authentication).

===============