SY0-701 Question 360
Single answerMultifactor authentication Implementations: Biometrics , Hard/soft authentication tokens , Security keysA financial services company is rolling out multifactor authentication for employees who access cloud-based administrative portals. The security team wants a solution that significantly reduces phishing risk, works well for users who travel frequently, and does not rely on cellular coverage. Some executives have requested fingerprint login on laptops, but the company's risk assessment notes that biometric data cannot be changed if compromised. Which authentication method is the BEST choice for the administrative portals?
- A
Require SMS-based one-time passwords sent to employees' mobile phones
- B
Deploy app-based soft tokens that generate time-based one-time passwords on user smartphones
- C
Issue FIDO2 security keys for users to authenticate to the portals
- D
Require fingerprint authentication as the second factor on all company laptops
Show answer and explanation
Correct answer: C
Explanation
The best answer is to issue FIDO2 security keys for administrative portal access. For high-value accounts, phishing resistance is a major requirement, and hardware security keys are widely recommended because they use public key cryptography and validate the origin of the authentication request. This makes them much more resistant to credential theft through spoofed login pages than SMS or TOTP-based methods. Soft tokens and hard OTP tokens can still be appropriate in many environments, but one-time passcodes are generally not considered phishing-resistant. Biometrics are useful for local device unlock or as part of MFA, but organizations must carefully consider privacy, storage, false acceptance/rejection rates, and the fact that biometric traits are not revocable in the same way as passwords or physical tokens. Guidance from NIST, including SP 800-63 Digital Identity Guidelines, favors phishing-resistant authenticators for higher-risk use cases, and industry best practice increasingly recommends FIDO2/WebAuthn security keys for privileged access.
- A. Incorrect.
SMS-based one-time passwords are a weak choice for this scenario. Although they provide a second factor, they depend on cellular service and are more susceptible to phishing, SIM-swapping, and message interception than phishing-resistant methods. A traveler without reliable cell coverage could be locked out, which directly conflicts with the scenario requirements.
- B. Incorrect.
App-based soft tokens using TOTP are better than SMS because they do not require cellular service once enrolled, making them practical for travelers. However, standard TOTP codes can still be phished through fake login pages or adversary-in-the-middle attacks because users can be tricked into entering the code. This makes soft tokens less effective than phishing-resistant authentication for high-risk administrative access.
- C. Correct.
FIDO2 security keys are the best choice. They are hardware-based authenticators that support phishing-resistant authentication by binding the authentication process to the legitimate site and cryptographic challenge, which helps prevent credential replay on fake portals. They also do not rely on cellular coverage and are well suited for protecting privileged or administrative accounts, aligning with current best practices for strong MFA.
- D. Incorrect.
Fingerprint authentication is biometric authentication and can be convenient, but it is not the best choice here. Biometrics cannot be changed like passwords or tokens if the underlying biometric template is compromised. In addition, laptop-based biometrics alone do not provide the same level of phishing resistance for cloud portal authentication as FIDO2 security keys. This option also ties the second factor to a specific device rather than providing a portable authenticator for traveling administrators.