問題文
A university wants users to be able to reset their password only after confirming two separate registered methods. Which statement about self-service password reset is correct?
選択肢
- Self-service password reset always requires exactly one method and cannot be changed, because a person who has forgotten their password is already in difficulty and requiring more than one proof would push too many of them back to the helpdesk the feature was meant to relieve.
- Requiring two methods is only possible by disabling self-service password reset and having the helpdesk perform the resets after verifying the caller twice, because the number of proofs is not part of the feature's configuration.
- The number of methods that a user must confirm to complete a reset is a configurable part of the self-service password reset settings, so the requirement can be raised from one method to two for the whole population.
- The requirement is set per user rather than per policy, so the university has to decide for each student and each member of staff how many methods that individual must confirm before their password can be reset.