SY0-701 Question 361
Single answerMultifactor authentication Implementations: Biometrics , Hard/soft authentication tokens , Security keysA healthcare organization is rolling out MFA for employees who access its cloud-based patient records system. The security team must reduce the risk of phishing and MFA fatigue attacks, support users who work from shared clinical workstations, and avoid requiring cellular service in restricted areas of the hospital. Which authentication method is the BEST choice to meet these requirements?
- A
Require SMS one-time passcodes as the second factor for all users
- B
Deploy app-based soft tokens that generate push approvals on employees' personal smartphones
- C
Issue FIDO2 security keys to employees for phishing-resistant MFA
- D
Use fingerprint biometrics alone on each workstation for passwordless access
Show answer and explanation
Correct answer: C
Explanation
The best answer is to issue FIDO2 security keys. In real-world enterprise deployments, hardware security keys are widely recommended when an organization wants phishing-resistant MFA. Unlike SMS and many push-based methods, FIDO2/WebAuthn authenticators are designed to resist phishing by binding authentication to the legitimate site or application origin. They also avoid dependence on cellular connectivity, which is important in environments such as hospitals where reception may be limited or devices may be restricted. Biometrics can still be useful, but on Security+ candidates must remember that biometrics are a factor category, not automatically MFA by themselves. Best-practice guidance from standards and industry sources such as NIST digital identity guidance and FIDO Alliance documentation supports phishing-resistant authenticators like hardware security keys for stronger MFA implementations.
- A. Incorrect.
Incorrect. SMS codes are a common MFA method, but they are not the best fit here. SMS depends on cellular service, which the scenario says may be unavailable in restricted hospital areas. SMS is also more susceptible to phishing, SIM-swapping, and interception risks than phishing-resistant methods. A candidate might choose this because SMS is familiar and widely deployed, but it does not best address the stated threat model.
- B. Incorrect.
Incorrect. App-based soft tokens and push approvals can provide MFA, but push-based authentication is specifically vulnerable to MFA fatigue attacks when users are repeatedly prompted to approve sign-in attempts. It also relies on users having access to their personal smartphones, which may be impractical or restricted in clinical environments. While soft tokens can work offline if they generate TOTP codes, the option specifically mentions push approvals, making it a weaker choice for this scenario.
- C. Correct.
Correct. FIDO2 security keys are a strong choice because they provide phishing-resistant MFA through public key cryptography and origin binding, making them far more effective against credential phishing than SMS or push approvals. Hardware security keys also do not require cellular service and are practical for shared workstations because the user can carry the key and authenticate without tying access to the workstation itself. This directly addresses the organization's concerns about phishing, MFA fatigue, and limited connectivity.
- D. Incorrect.
Incorrect. Fingerprint biometrics alone would provide only a single authentication factor: something you are. MFA requires at least two different factor types. In addition, relying only on workstation-based biometrics can be problematic on shared clinical systems due to enrollment, hygiene, privacy, and fallback access issues. Someone might choose this because biometrics are convenient, but convenience does not replace the requirement for multiple factors.