100-140 Question 146
Single answerA user contacts the IT support team stating that they are unable to log in to their corporate email account due to a forgotten password. As part of the password reset process, which action should you take to ensure the user's identity is verified before proceeding?
- A
Ask the user to provide their employee ID and verify it against the company database.
- B
Reset the user's password immediately without any further verification to save time.
- C
Request the user to send a verification email from their account to confirm their identity.
- D
Ask the user to answer specific security questions that were previously set up during account creation.
Show answer and explanation
Correct answer: D
Explanation
When resetting a password, verifying the identity of the user is critical to prevent unauthorized access. Asking the user to answer pre-configured security questions is a reliable and secure method because the answers are unique to the user and were set up during the account creation process. This ensures that the person requesting the reset is the legitimate account owner.
- A. Incorrect.
While verifying the employee ID against the company database is useful, it does not fully confirm the user's identity over the phone or email, as the ID could be compromised.
- B. Incorrect.
Resetting the password immediately without verification is a security risk and could lead to unauthorized access to the account.
- C. Incorrect.
Requesting a verification email from the user's account is not feasible, as the user cannot access their account due to the forgotten password.
- D. Correct.
Using pre-configured security questions is a standard and secure method to verify the identity of a user before resetting their password, as the answers are known only to the user.