Which component is commonly used as the second factor in Epic End User's two-factor authentication?

Which component is commonly used as the second factor in Epic End User's two-factor authentication?

• A. One-time code from an authenticator app.
• B. A daily password reset question.
• C. Only the username.
• D. A hardware token that stores the password.

Answer: (A)

In two-factor authentication, you prove who you are with two different kinds of evidence: something you know (your password) and something you have or are (the second factor). The most common second factor for Epic End User is a one-time code generated by an authenticator app. This code is created on a separate device you control, and it changes every short interval, so it’s not reusable. When you sign in, you enter your password and the current code from the app. Even if someone knows your password, they’d still need that live code to access the account, which greatly strengthens security. Daily password reset questions are static and can be guessed or researched, so they’re not a reliable real-time second factor. The username is just an identifier, not a factor used to prove you’re the account owner. A hardware token that stores the password isn’t the standard approach here and can introduce different security and usability issues; it doesn’t provide the short-lived, independently generated code that authenticator apps give.

In two-factor authentication, you prove who you are with two different kinds of evidence: something you know (your password) and something you have or are (the second factor). The most common second factor for Epic End User is a one-time code generated by an authenticator app. This code is created on a separate device you control, and it changes every short interval, so it’s not reusable. When you sign in, you enter your password and the current code from the app. Even if someone knows your password, they’d still need that live code to access the account, which greatly strengthens security.

Daily password reset questions are static and can be guessed or researched, so they’re not a reliable real-time second factor. The username is just an identifier, not a factor used to prove you’re the account owner. A hardware token that stores the password isn’t the standard approach here and can introduce different security and usability issues; it doesn’t provide the short-lived, independently generated code that authenticator apps give.