From a security viewpoint, a false acceptance is worse than a false rejection.

• A. True
• B. Both are equally bad
• C. False
• D. Neither affects security.

Answer: (C)

In authentication and access-control thinking, the key terms are false acceptance (an unauthorized user is granted access) and false rejection (a legitimate user is denied access). From a security perspective, letting an attacker in is the direct breach of confidentiality and integrity, which is typically considered the more serious risk. A false rejection mainly harms usability and availability, causing inconvenience but not an immediate security breach. Therefore, saying that a false acceptance is worse than a false rejection is not universally correct; the statement is false. In most security assessments, reducing false acceptance (FAR) is prioritized to prevent breaches, while some level of false rejection might be tolerated to maintain overall security.