712-50 · Question #246
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and…
The correct answer is B. Multi-factor authentication employing hard tokens. Multi-factor authentication (MFA) with hard tokens directly neutralizes phishing attacks because even if an attacker steals a user's password, they cannot authenticate without the physical token - making the compromised credential alone worthless. The scenario specifically asks…
Question
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self- Service application. All employees have access to the organizational VPN. The organization wants a more permanent solution to the threat to user credential compromise through phishing. What technical solution would BEST address this issue?
Options
- AProfessional user education on phishing conducted by a reputable vendor
- BMulti-factor authentication employing hard tokens
- CForcing password changes every 90 days
- DDecreasing the number of employees with administrator privileges
How the community answered
(30 responses)- A10% (3)
- B83% (25)
- C3% (1)
- D3% (1)
Explanation
Multi-factor authentication (MFA) with hard tokens directly neutralizes phishing attacks because even if an attacker steals a user's password, they cannot authenticate without the physical token - making the compromised credential alone worthless. The scenario specifically asks for a "permanent solution" to credential compromise, and MFA is the only technical control here that breaks the attack chain at the authentication layer rather than trying to prevent the phish from succeeding in the first place.
Why the distractors fail:
- A (user education) reduces phishing susceptibility but is behavioral, not technical, and humans remain fallible - the scenario explicitly asks for a technical and permanent solution.
- C (90-day password rotation) only limits the window of exposure after a credential is stolen; it doesn't stop an attacker who uses it immediately after phishing.
- D (fewer admin privileges) is good least-privilege hygiene but doesn't protect regular user accounts from being phished, which is the stated threat.
Memory tip: Think of MFA as a "two-key missile launch" - one stolen key (password) is useless without the second physical key (hard token). Whenever an exam scenario asks for a technical fix to credential theft or phishing, MFA/hard tokens is almost always the answer because it renders the stolen credential insufficient on its own.
Topics
Community Discussion
No community discussion yet for this question.