A systems analyst is concerned that the current authentication system may not provide the appropriate level of security. The company has integrated WAYF within its federation system and implemented…

Security awareness training is not a technical solution and does not address the automated credential-relay mechanism at the protocol level.

Push-based authentication is vulnerable to MFA fatigue attacks where users inadvertently approve fraudulent prompts, and does not inherently block real-time relay of credentials through a phishing proxy.

TOTP codes are derived from a shared secret and the current Unix timestamp, producing codes valid for only a short window - typically 30 seconds - and most implementations reject duplicate codes within that window. Even if a phishing proxy captures and immediately attempts to replay a TOTP code, the narrow expiry window severely limits the usability of the stolen credential. This directly counters the automated collect-and-replay attack model described in the scenario.

OAuth tokens are an authorization delegation framework used after authentication is established, and do not protect against theft and replay of the initial authentication credentials.

Shibboleth is a federated identity provider already implied by the WAYF integration in the scenario; its presence alone does not prevent phishing-based credential capture and replay.