Your Chief Executive Officer lost his phone and cannot perform MFA to log in to work. How can you enable him to bypass MFA right away and not delay his work?

Question

Options

• AAdd a security question to his account on his behalf.
• BAsk him to configure on-device authenticator.
• CAsk him to change his phone PIN.
• DSelect the MFA Unlock action for him through the Admin Portal.

• A
  17% (12)
• B
  4% (3)
• C
  6% (4)
• D
  72% (50)

Explanation

Option D is correct because when a user is locked out of MFA (e.g., lost device), an administrator can use the MFA Unlock action in the Admin Portal to temporarily bypass or reset the MFA requirement for that specific account - this is the proper, immediate administrative remedy designed for exactly this scenario.

Why the distractors are wrong:

• A (Security question): Adding a security question doesn't bypass MFA; it's a separate authentication factor and wouldn't resolve the current lockout.
• B (On-device authenticator): The CEO can't configure a new authenticator because he can't log in - he's stuck in a chicken-and-egg problem; setup requires access he doesn't have.
• C (Change phone PIN): The PIN unlocks the physical device, not the MFA system; if the phone is lost, changing its PIN is irrelevant to account access.

Memory tip: Think of it as "admin unlocks the door" - just as a building security admin can let someone in when they forget their keycard, an IT admin uses the Admin Portal's MFA Unlock action to grant immediate, controlled access without requiring the user to have their device.

No community discussion yet for this question.