BA-201 · Question #288
A cloud Kicks business analyst (BA) is conducting user interviews with the support team as part of a migration to Salesforce. Serval users indicate they use multi-factor authentication (MFA) on…
The correct answer is B. Verify the requirement with the security team. When users report conflicting authentication practices, the BA must verify the requirement with the security team because authentication policies are governed by security, not by user preference or majority vote.
Question
A cloud Kicks business analyst (BA) is conducting user interviews with the support team as part of a migration to Salesforce. Serval users indicate they use multi-factor authentication (MFA) on their phones to log in to existing systems. Other users have located they access existing systems with only username and password. Which action should the BA take?
Options
- ASelect the requirement used by the majority of the support team.
- BVerify the requirement with the security team.
- CBring the requirement to the product owner's attention.
How the community answered
(31 responses)- A23% (7)
- B68% (21)
- C10% (3)
Why each option
When users report conflicting authentication practices, the BA must verify the requirement with the security team because authentication policies are governed by security, not by user preference or majority vote.
Selecting the requirement used by the majority ignores that security policy is not a democratic decision; a minority-used control like MFA may in fact be the mandated or compliant approach.
Authentication requirements such as MFA are typically mandated by organizational security policy, compliance obligations, or IT governance - not by individual user preference. Bringing the conflicting information to the security team ensures the official policy is identified and documented as the true requirement. This prevents the project from implementing a configuration that violates security standards.
While the product owner has authority over backlog prioritization, security and authentication policy is a technical governance matter that belongs with the security team, not the product owner.
Concept tested: Handling conflicting security requirements with stakeholders
Source: https://help.salesforce.com/s/articleView?id=sf.security_overview_2fa.htm&type=5
Topics
Community Discussion
No community discussion yet for this question.