Which PIN action must occur when a TA enrolls a token?

• A. The subscriber must verify PIN with supervisor
• B. The subscriber must reset their PIN themselves
• C. The TA must reset the subscriber's PIN
• D. The PIN is not required

Answer: (B)

PIN handling during token enrollment centers on user control and credential secrecy. The subscriber should set or reset their own PIN so only they know it. This ensures they own the PIN and prevents the TA or an administrator from knowing it, which is critical for security and accountability. Requiring verification with a supervisor adds unnecessary steps and doesn’t guarantee ownership. If the TA resets the PIN, the PIN would be exposed to the administrator, introducing a security risk. Saying the PIN isn’t required contradicts the purpose of protecting access to the token. Therefore, the action that must occur is the subscriber resets their PIN themselves.