This question's explanation and your answers so far.
A 社では, 従業員の利用者 ID とパスワードを用いて社内システムの利用者認証を行っている。セキュリティを強化するために, このシステムに新たな認証機能を一つ追加することにした。認証機能 a～c のうち, このシステムに追加することによって, 二要素認証になる機能だけを全て挙げたものはどれか。 a A社の従業員証として本人に支給している IC カードを読み取る認証 b あらかじめシステムに登録しておいた本人しか知らない秘密の質問に対する答えを入力させる認証 c あらかじめシステムに登録しておいた本人の顔の特徴と, 認証時にカメラで読み取った顔の特徴を照合する認証
This lists only a (IC card = possession factor), but the face authentication in c is also a “biometric” factor, so combining it with the password (knowledge) likewise results in two-factor authentication. Because it does not include c, the list is incomplete and therefore wrong.
Including b is the mistake. The answer to the secret question in b is the same “knowledge” factor as the password; stacking another knowledge factor on the existing password keeps it to a single type of factor, so it does not become two-factor.
正解 Two-factor authentication combines two different factors out of the three authentication factors: “knowledge (something only the person knows),” “possession (something only the person has),” and “biometrics (the person's physical characteristics).” The ID and password in the current system are a “knowledge” factor. Adding the IC card in a introduces a “possession” factor, so knowledge + possession makes two factors. Adding the face authentication in c introduces a “biometric” factor, so knowledge + biometrics makes two factors. Therefore the features that result in two-factor authentication are a and c, and the correct answer is “a, c,” which is “ウ”.
A double error: it includes b while omitting a. b (secret question = knowledge factor) is the same type as the password and does not make two factors, while a (IC card = possession factor), which does make two factors, is left out.