A security administrator is developing training for corporate users on basic security principles for personal email accounts. Which of the following should be mentioned as the MOST secure way for…

Utilizing a single security question is inherently less secure due to the potential for social engineering or the ease with which such information can be guessed or researched, making it a weak knowledge-based factor.

Sending a PIN to a smartphone through text message leverages multi-factor authentication (MFA) by utilizing 'something you have' (the phone), providing a stronger verification method than relying solely on knowledge-based factors. This approach significantly reduces the risk of unauthorized account access during recovery, as an attacker would need physical possession of the device or the ability to intercept SMS messages, making it the most secure option among those listed.

CAPTCHA is a mechanism to prevent automated attacks like brute force during a login or recovery process, but it does not serve as a primary password recovery method itself.

While using a different email address for recovery is a common method, it is generally less secure than a device-based token because both email accounts could potentially be compromised or lost access to simultaneously, and it does not add a distinct factor of authentication.