What must be verified before modifying any authentication credential via non-face-to-face method?

• A. User's identity is verified before credential modification.
• B. Admin approves after change.
• C. Identity verification is not required.
• D. Password must be changed first.

Answer: (A)

When credentials are being changed remotely, you must positively confirm who you’re dealing with before making any modification. Verifying the user’s identity first ensures the request is legitimate and authorized by the actual account owner, which is crucial because you’re altering access rights without in‑person verification. If you skip identity verification, an attacker who can initiate a remote change could gain control of the account, defeating the purpose of strong authentication controls.

In practice, this verification might involve multi-factor authentication, out-of-band verification, or other proven methods to establish the person’s identity before you proceed with updating credentials. Once identity is confirmed, you can complete the credential modification securely and document the change for auditing.

Relying on post-change approval would not prevent an unauthorized change from occurring, and saying identity verification isn’t required would leave accounts vulnerable. Requiring a password change first is not a universal requirement for every remote credential modification.