220-1102 Question 335
Single answerLogical securityA small accounting firm is tightening logical security after an employee's password was guessed and used to access payroll data from outside the office. The firm wants a solution that reduces the chance of unauthorized access even if a password is compromised, while keeping remote access practical for employees. Which of the following is the BEST recommendation?
- A
Require multifactor authentication for remote access and payroll-related systems
- B
Increase the minimum password age so users cannot change passwords frequently
- C
Disable account lockout policies to prevent help desk calls from mistyped passwords
- D
Share a single strong administrative account among payroll staff to simplify auditing
Show answer and explanation
Correct answer: A
Explanation
The best answer is to require multifactor authentication for remote access and payroll-related systems. In logical security, authentication controls should reduce reliance on passwords alone, especially for sensitive business functions and remote access where exposure is higher. MFA is widely recommended by security best practices, including guidance from NIST and common enterprise security standards, because it helps prevent account compromise even when a password has been guessed or stolen. The other options either fail to address the actual threat, weaken security controls, or create accountability problems. In a real A+ Core 2 environment, technicians should recognize MFA, least privilege, unique user accounts, and properly configured lockout policies as foundational logical security measures.
- A. Correct.
Correct. Multifactor authentication (MFA) is one of the most effective logical security controls for reducing unauthorized access when passwords are guessed, stolen, or reused. Requiring a second factor, such as an authenticator app, hardware token, or biometric factor, significantly improves security for remote access and sensitive systems like payroll. This directly addresses the scenario's concern that a password alone was not sufficient protection.
- B. Incorrect.
Incorrect. Increasing the minimum password age controls how soon a user can change a password again, which is typically used to prevent users from cycling through old passwords to bypass password history requirements. It does not meaningfully reduce the risk of an attacker using a guessed password to log in. Someone might choose this option because it sounds like a password policy improvement, but it does not solve the main problem in the scenario.
- C. Incorrect.
Incorrect. Account lockout policies are a standard defense against repeated password-guessing attempts. Disabling them would weaken logical security and could make brute-force attacks easier. Although lockouts can increase support calls, the proper response is to tune thresholds and durations appropriately, not remove the control entirely.
- D. Incorrect.
Incorrect. Shared accounts are a poor security practice because they eliminate individual accountability and make auditing difficult. Even if the shared password is strong, using one account for multiple payroll employees weakens access control and violates the principle of least privilege and standard auditing practices. A candidate might pick this option thinking a stronger shared password is easier to manage, but it creates major security and compliance issues.