AP Subject A 20: User Authentication, MFA, Biometrics, Authorization, and Access Control

2026 exam basis · revised/sources checked 2026-10-21

Learning index

1. Official scope and terms 2. Factors and MFA 3. OTP, challenge-response, and SSO 4. Authentication and authorization 5. Least privilege, separation of duties, and RBAC 6. Access-decision trace 7. Biometric FAR/FRR 8. Password storage and transport 9. Exam traps 10. Quick sheet and review 11. Questions

1. Official scope and terms

In IPA Ver.7.2, operations and user management under Software > Operating System is on PDF page 29 / printed page 25; inadequate separation of duties as an organizational vulnerability is on PDF 53 / printed 49; authentication, user authentication, and biometric authentication are on PDF 55 / printed 51; and account and user-access-right management is on PDF 56 / printed 52. PDF and printed-page numbers are distinct. AP19’s cryptographic internals and certificate chains are not repeated; attack catalogs and operational defenses are deferred to AP21.

KO	JA	EN
인증	認証	authentication
인가	認可	authorization
지식 요소	知識要素	knowledge factor
소유 요소	所有要素	possession factor
생체(고유) 요소	生体要素	inherence/biometric factor
다요소 인증	多要素認証	multi-factor authentication (MFA)
일회용 비밀번호	ワンタイムパスワード	one-time password (OTP)
싱글 사인온	シングルサインオン	single sign-on (SSO)
최소 권한	最小権限	least privilege
직무 분리	職務分掌	separation of duties
역할 기반 접근 제어	ロールベースアクセス制御	role-based access control (RBAC)
타인 수락률 / 본인 거부율	他人受入率／本人拒否率	FAR / FRR

2. Authentication factors and MFA

• Knowledge is something the user knows: a password or PIN.
• Possession proves control of something the user has: a registered authenticator, security key, or OTP device. Knowing an account name is not possession.
• Inherence/biometric is a physical characteristic of the user, such as a fingerprint or face.

A password followed by a PIN is two steps but both are knowledge, so it is not true MFA. A password plus proof of control of a registered security key uses two distinct categories and is MFA. Count independent factor categories, not screens. One multi-factor authenticator can internally require two factors, so one authenticator does not necessarily mean one factor. Multi-stage authentication merely describes a sequence; it is MFA only when distinct categories are required.

3. OTP, challenge-response, and SSO

• An OTP is a secret value valid once or briefly. Proving control of an OTP device is generally possession, but the label OTP alone does not make an entire login MFA.
• Challenge-response gives the authenticator a fresh challenge and returns a response proving control of a secret/key. This differs from simply retransmitting a static password.
• SSO uses one authentication/session, or an assertion from a federated IdP, across multiple services. It reduces repeated logins but does not make each service’s authorization decisions identical. A security token can carry the assertion.

These are functional, exam-level descriptions. Cryptographic internals belong to AP19; attack and operational-defense catalogs belong to AP21.

4. Authentication versus authorization

Authentication establishes that a claimant controls a stated identity or authenticator. Authorization decides which actions on which resources are permitted using that identity context or another policy context. Successful authentication does not grant every action. Authorization can also be conceptually independent of authentication: policy may allow anonymous reading of public material.

For example, successful login by synthetic user Mina does not permit approval when she has only purchase:create. She may create a request; approval is a separate authorization decision.

5. Least privilege, separation of duties, and RBAC

• Least privilege/need-to-know grants only the actions, resources, and duration needed for work.
• Separation of duties divides a sensitive transaction among conflicting roles so one person cannot complete it alone.
• RBAC assigns permissions to roles and users to roles. Roles may be constrained or mutually exclusive.

In the purchase case, Requester has create and Approver has approve. Nobody should perform both on the same transaction. Merely using RBAC does not automatically guarantee least privilege or separation of duties. Policy and design must prevent overpowered roles, conflicting assignments, and missing transaction-level constraints.

6. Worked access-decision trace

Apply the following policy to synthetic transaction PO-204, amount KRW 800,000.

1. Mina authenticates with a password and registered security key: knowledge+possession MFA succeeds.
2. The directory maps Mina to Requester, which has only purchase:create.
3. Mina creates PO-204: required permission is present, so allow and record creator=Mina.
4. Mina tries to approve the same transaction: purchase:approve is absent, so deny.
5. Jun authenticates as Approver and attempts approval: approve permission is present and creator differs, so allow.
6. Even if Jun also holds Requester, separately enforce the dynamic separation constraint that a transaction’s creator and approver differ.

The decision combines authentication results, role permissions, resource/action, transaction state, and separation-of-duties constraints.

7. Biometric FAR and FRR

Declare the convention first: this is a similarity score, higher means more similar, and accept when score >= threshold T. Under the same fixed data, population, and capture conditions, raising T is stricter: measured FAR cannot increase (is non-increasing), while FRR cannot decrease (is non-decreasing). Lowering T reverses those directions. A distance-score system, where lower means closer, uses the opposite inequality and threshold direction.

• 20 false accepts from 100,000 impostor attempts: FAR = 20 / 100,000 = 0.0002 = 0.02%.
• 30 false rejects from 2,000 genuine attempts: FRR = 30 / 2,000 = 0.015 = 1.5%.

The denominators differ, so do not add FAR and FRR. The fractions, decimals, and percentages above were independently checked. EER is the operating point in a defined test where FAR and FRR are equal, not a universal constant. These are synthetic aggregate counts, not real personal or biometric data.

8. Password storage and transport protection

For storage, generate a unique random salt per password and compute a verifier with a password-focused slow/adaptive KDF such as PBKDF2, bcrypt, scrypt, or Argon2. Store the salt with the verifier; it need not be secret. At login, recompute with the same salt and settings and compare. These examples do not prescribe universal parameters; selection depends on policy and environment.

Transport encryption such as TLS protects credentials in transit, but it does not replace a salted slow verifier at rest. The verifier likewise does not replace transport protection. Reversible encryption of stored passwords is not a substitute for a salted slow verifier. Hash and cryptographic internals remain in AP19.

9. Exam traps

• Do not confuse step count with factor-category count: password+PIN is two steps, one factor.
• Do not confuse successful authentication with permission. SSO does not remove service-specific authorization.
• RBAC does not automatically enforce least privilege or separation of duties.
• Identify similarity versus distance score and the acceptance inequality before reasoning about thresholds.
• FAR’s denominator is impostor attempts; FRR’s is genuine attempts.
• TLS and safe storage protect different parts of the path.

10. Quick sheet, self-check, and 1/3/7-day review

• Quick sheet: knowledge=password/PIN, possession=registered device/key, biometric=fingerprint/face; authentication=who/control, authorization=what is allowed; RBAC=user→role→permission; similarity accepts score>=T, so T↑ gives FAR↓/same and FRR↑/same.
• Self-check: Can you explain why password+PIN is not MFA, how SSO differs from authorization, the two denial conditions in the purchase trace, the FAR/FRR denominators, and the separate roles of salt and TLS?
• Day 1: rewrite the factor table and access trace. Day 3: calculate the rates and threshold direction unaided. Day 7: retake all five questions and explain every rejected option.

11. Five original four-choice questions

Q1

Which is true MFA? ア A password followed by another password. イ A PIN followed by a security-question answer. ウ A password plus proof of control of a registered security key. エ The same password entered on two screens.

Answer: ウ (3). ア is knowledge+knowledge. イ is also knowledge+knowledge. ウ combines distinct knowledge and possession categories. エ adds a screen, not a factor.

Q2

Which statement about authentication and authorization is correct? ア Successful login permits every resource. イ Authentication establishes identity/authenticator control; authorization decides permitted actions and resources. ウ Authorization must check a password. エ SSO makes permissions identical at every service.

Answer: イ (2). ア mistakes authentication for unlimited authority. イ distinguishes the decisions correctly. ウ confuses authorization with an authentication ceremony. エ confuses common login with service policy.

Q3

A similarity system accepts score >= T. In a fixed test it accepts 20 of 100,000 impostor attempts and rejects 30 of 2,000 genuine attempts. Which is correct? ア FAR 0.2%, FRR 15%; raising T decreases both. イ FAR 0.02%, FRR 1.5%; raising T increases both. ウ FAR 1.5%, FRR 0.02%; raising T increases FAR. エ FAR 0.02%, FRR 1.5%; raising T makes FAR non-increasing and FRR non-decreasing.

Answer: エ (4). ア makes both rates ten times too large and gets direction wrong. イ has the rates but not FAR direction. ウ swaps denominators and gets direction wrong. エ has both arithmetic and similarity-threshold direction right.

Q4

Which purchase RBAC and separation-of-duties design is best? ア Give create to Requester and approve to Approver, then enforce that creator and approver differ on the same transaction. イ Give both permissions to every role; RBAC separates them automatically. ウ Giving one user both roles automatically ensures least privilege. エ Skip role checks after authentication.

Answer: ア (1). ア combines role permissions with a transaction constraint. イ falsely assumes automatic enforcement. ウ ignores excessive privilege and conflict. エ confuses authentication and authorization.

Q5

Which password-protection statement is correct? ア With TLS, plaintext server storage is acceptable. イ One shared salt and one fast hash is enough. ウ Store a per-password random salt and slow/adaptive-KDF verifier, and separately use TLS in transit. エ Reversible storage encryption is always better than a verifier.

Answer: ウ (3). ア leaves storage exposure. イ omits unique salts and deliberate cost. ウ protects storage and transport separately. エ incorrectly treats recoverable passwords as a substitute.

Answer key: [3, 2, 4, 1, 3] = [ウ, イ, エ, ア, ウ]

Official sources and notice

First-party sources checked 2026-10-21: IPA syllabus Ver.7.2, NIST SP 800-63B-4, NIST SP 800-63C-4, and NIST SP 800-53 Rev.5 Update 1. The NIST RBAC project is an archived foundational project page and is used here only for the user→role→permission model.

This independently written study guide is not affiliated with IPA or NIST. It uses no past questions, third-party commentary, or real personal/biometric data and does not guarantee exam success.