Discuss ISC2 CISSP Exam Topic 1 Question 51

An information security professional is reviewing user access controls on a customer-facing application. The application must have multi-factor authentication (MFA) in place. The application currently requires a username and password to login. Which of the following options would BEST implement MFA?

AGeolocate the user and compare to previous logins

BRequire a pre-selected number as part of the login

CHave the user answer a secret question that is known to them

DEnter an automatically generated number from a hardware token

Suggested Answer: C

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Alita 11 months ago

Wait, secret questions? Aren't they easy to guess?

Talia 11 months ago

Geolocation isn't reliable enough for MFA, so A is a no-go.

Amber 11 months ago

I agree, D is the most secure method!

Steffanie 11 months ago

Not sure if a hardware token is really necessary though.

Reita 11 months ago

Option D is definitely the best choice for MFA!

Mabel 12 months ago

Geolocation seems interesting, but I feel like it might not be reliable enough for MFA.

Christiane 12 months ago

I practiced a similar question where they asked about different authentication methods, and I think secret questions aren’t very secure.

Jamey 12 months ago

I’m not entirely sure, but I think option D with the hardware token sounds like the best choice for true MFA.

Markus 1 year ago

I remember studying that MFA should involve something you have, something you know, or something you are.

Vicky 1 year ago

Hmm, I'm not sure about the other options. I know OSPF has some advanced features, but I'll have to think this through carefully.

Mira 1 year ago

Hmm, this is a tricky one. I'll need to think carefully about the Scrum principles and how they apply here.

Devora 1 year ago

Hmm, I'm a bit unsure about this one. The options seem to cover different potential red flags, but I'll need to think through which ones are most indicative of auditor fraud specifically.

Carma 1 year ago

I remember studying WCF connections but can't recall if NET Remoting is actually supported. I think I've seen practice questions on it before.

ISC2 CISSP Exam - Topic 1 Question 51 Discussion