A consultant is performing a social engineering attack against a client. The consultant was able to collect a number of usernames and passwords using a phishing campaign. The consultant is given…

A strong password policy would not have prevented this attack because phishing deceives users into voluntarily submitting their real passwords, bypassing complexity or length requirements entirely.

Password encryption protects credentials stored in databases or transmitted over the network but does not prevent a user from being tricked into typing their password directly into an attacker-controlled site.

Email system hardening can reduce the deliverability of phishing messages but does not address the scenario where credentials have already been harvested and are being used to authenticate.

Two-factor authentication requires a second verification factor - such as a one-time passcode or hardware token - beyond the username and password. Since the phishing campaign successfully captured valid credentials, 2FA ensures those credentials cannot be used in isolation, meaning the attacker cannot authenticate even with the correct password.