220-1102 Question 341
Single answerHardware tokenA company requires remote employees to use MFA when signing in to its VPN. One user can enter the correct username and password, but the login still fails because the user no longer has the small USB security device that was issued during enrollment. The help desk must restore access while maintaining the MFA requirement. What is the BEST next step?
- A
Temporarily disable MFA for the user until a replacement device arrives
- B
Issue a replacement hardware token and revoke the lost token in the authentication system
- C
Have the user share a coworker's token until a new one can be assigned
- D
Reset the user's password and instruct the user to try again without the token
Show answer and explanation
Correct answer: B
Explanation
A hardware token is a possession factor used for multifactor authentication. When a token is lost, the proper response is to revoke or disable that token in the authentication platform and issue a replacement or follow the organization's approved MFA recovery process. This preserves security, maintains auditability, and prevents a potentially lost or stolen token from being used. Common security guidance from identity providers and enterprise access control best practices emphasizes not sharing authenticators, not bypassing MFA unless there is a formal emergency exception, and promptly deactivating lost authentication devices.
- A. Incorrect.
This is incorrect because disabling MFA weakens security and removes the additional factor required by company policy. Best practice is to keep MFA enforced and use an approved recovery or re-enrollment process rather than bypassing it simply for convenience.
- B. Correct.
This is correct because a lost hardware token should be treated as a security risk and invalidated in the identity or MFA system. Issuing a replacement token and revoking the old one restores access while preserving the required second factor. This matches standard security practice for token lifecycle management.
- C. Incorrect.
This is incorrect because hardware tokens are assigned to an individual identity and should not be shared. Sharing a coworker's token breaks accountability, violates security policy, and can create audit and authentication issues.
- D. Incorrect.
This is incorrect because resetting the password addresses only the knowledge factor. If MFA is required, the user still needs the possession factor, such as the assigned hardware token or an approved replacement. Password resets do not solve a missing token problem.