I85PREP
⌘ K
PSAP study materials
PSAP study resources

PSAP: Credentials, Readers, and Identity Verification Technologies

PSAP · Work through your exam, one topic at a time.

All guide sections

Credentials, Readers, and Identity Verification Technologies

This domain tests how identity is enrolled, bound to a credential, presented at a reader, and revoked. Expect questions on card technologies, mobile credentials, biometrics, PINs, authentication factors, and identity proofing.

Credential types

  • Something you have: proximity card, smart card, mobile credential, key fob.
  • Something you know: PIN or password.
  • Something you are: fingerprint, iris, face, or voice.
  • Multifactor authentication combines factors; two cards or a card plus its serial number are not true multifactor.

Reader technologies

Low-frequency 125 kHz proximity cards are easy to clone and should not be treated as high security. Smart cards such as MIFARE DESFire support encrypted, mutually authenticated transactions. OSDP Secure Channel provides encryption and authentication between reader and controller. Mobile credentials use NFC or Bluetooth with app-level protections. Biometrics compare a live sample to a protected template and must address false acceptance, false rejection, and liveness.

Enrollment and revocation

Identity proofing should verify the person before a credential is issued. The credential must be bound to a unique identity, not just a card number. Revocation must be prompt and tested. Lost or stolen cards, terminated employees, and shared PINs are common failure points.

Worked example

A lobby door needs moderate security; a data center cage needs high security. For the lobby, a smart card with a PIN may be proportionate. For the cage, use a smart card with mutual authentication plus biometric verification, and require dual authorization for entry. The reasoning is risk-based: higher consequence justifies stronger authentication and greater assurance that the credential has not been cloned.

Traps

Do not treat a card serial number or UID as a secret. Do not confuse identification with authorization. Do not ignore credential revocation or template privacy. Do not accept biometric accuracy claims without FAR, FRR, and liveness testing.