220-1101 Question 328
Single answerUser authenticationA small medical office uses a cloud-based patient scheduling application. Staff members currently sign in with only a username and password. After a phishing incident, the office manager asks the technician to improve user authentication without replacing the application. The application already supports app-based verification codes and hardware security keys. Which option would BEST strengthen authentication for employees while keeping the solution practical for daily use?
- A
Enable multifactor authentication for all staff using an authenticator app or hardware security key in addition to passwords
- B
Increase the minimum password length requirement from 8 characters to 12 characters and keep password-only logins
- C
Configure the application to lock accounts after one failed sign-in attempt
- D
Require employees to share one generic office account so the password can be controlled centrally
Show answer and explanation
Correct answer: A
Explanation
The best answer is to enable multifactor authentication (MFA). In A+ objectives related to security and authentication, MFA is a key best practice because it combines multiple authentication factors, such as something you know (password) with something you have (authenticator app or hardware token/security key). This is especially effective against phishing-related credential theft because possession of the password alone is no longer sufficient. Password policy improvements are helpful, but they are not as effective as MFA against real-world account compromise. Similarly, lockout settings must be balanced to avoid denial-of-service conditions against legitimate users. Shared accounts should be avoided because they undermine nonrepudiation, auditing, and least-privilege practices. Guidance from common security best practices, including NIST digital identity guidance and vendor security baselines from major cloud providers, consistently recommends MFA as one of the most effective controls for protecting user authentication.
- A. Correct.
Correct. Enabling multifactor authentication (MFA) adds a second factor beyond something the user knows (a password). Using an authenticator app or a hardware security key significantly reduces the risk from stolen passwords, which is especially important after a phishing incident. This is practical because the application already supports these methods, so the organization can improve authentication without replacing the software.
- B. Incorrect.
Incorrect. Increasing password length does improve password strength and is a good security practice, but it does not address the core problem of compromised credentials being used after phishing. If an attacker steals a valid password, a longer password requirement alone will not stop that attacker from signing in.
- C. Incorrect.
Incorrect. Account lockout can help slow brute-force attacks, but locking an account after a single failed attempt is too aggressive and would create frequent support issues from normal typing mistakes. It also does not directly solve the risk of a phished password being used successfully on the first try.
- D. Incorrect.
Incorrect. Shared accounts weaken security and accountability because actions cannot be tied to an individual user. This also violates basic access control and auditing best practices. Central control of a single shared password does not improve authentication security and can make incidents harder to investigate.