When is a user asked to answer a security question before they can log in to NetSuite?

NetSuite enhances account security by challenging users to answer a pre-configured security question when a login attempt occurs from an unrecognized device or browser. This identity verification step is triggered because NetSuite uses browser cookies to remember trusted computers. If this cookie is not present, as is the case with a new computer, a different browser, or after clearing cookies, the system requires this additional authentication factor to ensure the user is legitimate, even if the password provided is correct.

A. An incorrect password results in a login failure message. The system does not proceed to a security question challenge if the primary credential is not validated.
B. Two-factor authentication (2FA) is a separate security layer that requires a time-based verification code from an authenticator application, not an answer to a security question.
C. A user changing their password is an action performed after they have already been authenticated and logged in. This process does not trigger a security question challenge.

1. NetSuite Help Center. Security Questions for User Authentication. SuiteAnswers, Answer ID: 10092. Retrieved from NetSuite Application.

Quote: "When you log in to NetSuite from a new computer or a new browser, you are prompted to answer one of your security questions. This security measure is required for all NetSuite accounts. It is designed to prevent unauthorized users from accessing your account, even if they have your password."

2. NetSuite Help Center. Setting Up Security Questions. SuiteAnswers, Answer ID: 72237. Retrieved from NetSuite Application.

Reference: This document outlines the process for users to set up their security questions and answers, which are then used for the identity verification process described in Answer ID 10092.

3. NetSuite Help Center. Logging In to NetSuite. NetSuite 2023.2.

Reference: The "Identity Confirmation on a New Device or Browser" section details this specific security feature, stating that if you log in from a device or browser that NetSuite does not recognize, you will be prompted to confirm your identity by answering a security question.