220-1102 Question 402
Single answerMultifactorA small medical office requires employees to use multifactor authentication (MFA) for remote access to the patient scheduling system. Several employees share a front desk workstation and do not carry company-issued phones. The office manager wants a solution that improves security without relying on SMS delivery or personal mobile devices. Which of the following is the BEST MFA method to implement for these users?
- A
Require users to enter only a complex password that is changed every 30 days
- B
Send a one-time code by SMS to each employee's personal phone
- C
Issue hardware tokens that generate time-based one-time passwords for each employee
- D
Store a shared recovery code in a desk drawer for front desk staff to use when signing in
Show answer and explanation
Correct answer: C
Explanation
The best answer is to issue hardware tokens that generate time-based one-time passwords. MFA requires two or more authentication factors from different categories, such as something you know, something you have, or something you are. In this scenario, the users already have a password as the knowledge factor, and a hardware token adds a possession factor without depending on SMS or mobile devices. This is a practical real-world solution for shared workstations and regulated environments such as medical offices, where individual accountability and reliable access are important. Security best practices from organizations such as NIST generally favor phishing-resistant or stronger possession-based authentication methods over SMS when feasible, and they emphasize protecting recovery methods and avoiding shared credentials or shared secrets.
- A. Incorrect.
This is incorrect because a password alone is single-factor authentication, not multifactor authentication. Even if the password is complex and rotated regularly, it does not satisfy the requirement for a second factor. This reflects a common misconception that stronger passwords can replace MFA.
- B. Incorrect.
This is incorrect because, although SMS codes can be used as a second factor, the scenario specifically states that the office manager does not want to rely on SMS delivery or personal mobile devices. In addition, SMS is generally considered weaker than app-based or hardware-token-based methods due to risks such as SIM swapping and message interception.
- C. Correct.
This is correct because a hardware token provides a separate authentication factor based on something the user has. Time-based one-time password (TOTP) tokens are practical in shared-workstation environments and do not depend on employees having company phones, personal phones, or cellular service. Assigning each employee an individual token preserves accountability and supports stronger authentication practices.
- D. Incorrect.
This is incorrect because a shared recovery code defeats individual accountability and creates a serious security risk. Recovery codes are intended for exceptional account recovery, not routine sign-ins, and should be protected carefully. Leaving one in a desk drawer would allow unauthorized access and undermine the purpose of MFA.