220-1102 Question 339
Single answerMultifactor authentication (MFA)A company requires multifactor authentication (MFA) for remote access to its VPN. Several sales employees report that they can enter their usernames and passwords successfully, but they cannot complete the second step after getting new smartphones. The employees can still receive phone calls and text messages, but the authenticator app on the new phones is not generating valid codes. The help desk wants the most secure solution that restores access without weakening MFA for all users. Which of the following should the technician do FIRST?
- A
Temporarily disable MFA on the affected accounts until the users can re-enroll their authenticator apps
- B
Switch all affected users from authenticator app codes to SMS-based codes permanently
- C
Use the MFA provider's account recovery or device re-registration process to bind the new phones to the users' accounts
- D
Reset each user's VPN password because invalid one-time codes usually indicate incorrect passwords
Show answer and explanation
Correct answer: C
Explanation
The best first step is to use the MFA provider's approved recovery or device re-registration process so the new smartphones can be enrolled as the second factor. In real-world environments, replacing a phone commonly breaks app-based MFA because the new device no longer has the original enrollment secret used to generate time-based one-time passwords. Best practice is to preserve MFA and restore the registered factor, not disable MFA or permanently downgrade to a weaker method such as SMS unless policy or emergency procedures require it. This aligns with common vendor guidance from MFA platforms such as Microsoft, Google, Cisco Duo, and Okta, which provide account recovery, new device enrollment, and factor reset procedures for lost or replaced devices.
- A. Incorrect.
This is incorrect because disabling MFA removes an important security control and exposes remote access accounts to greater risk, especially for VPN access. Although it may restore access quickly, it weakens security rather than addressing the root cause. A+ best practices emphasize maintaining security controls whenever possible and using approved recovery procedures instead of bypassing them.
- B. Incorrect.
This is incorrect because SMS can be used as a second factor, but it is generally considered less secure than app-based authenticator codes due to risks such as SIM swapping and interception. Permanently downgrading all affected users to SMS is not the most secure response when a proper re-registration process is available. A technician should restore the stronger factor instead of replacing it unnecessarily.
- C. Correct.
This is correct because when users replace phones, the authenticator app on the new device usually must be re-enrolled or re-associated with the MFA account. Time-based one-time password (TOTP) apps rely on a shared secret configured during enrollment, and that secret does not automatically transfer unless the MFA system and app support a secure migration process. Using the MFA provider's documented recovery or re-registration workflow restores access while preserving MFA.
- D. Incorrect.
This is incorrect because the scenario states the users can successfully enter their usernames and passwords, so the primary authentication factor is already working. The problem is specifically with the second factor on the new phones. Resetting the VPN password does not fix an authenticator app that has not been properly enrolled.