A company purchases cyber insurance and the insurer requires the organization to demonstrate multi-factor authentication (MFA) on all remote access and privileged accounts. The IT team currently uses username/password only for VPN and RDP.
What authentication factor categories does MFA require, and which combination is most commonly deployed for remote access?
- A.Two passwords of different lengths
- B.At least two factors from different categories: something you know (password), something you have (TOTP app/hardware token), or something you are (biometric); commonly: password + TOTP app (e.g., Google Authenticator or Microsoft Authenticator)
- C.A username and an email confirmation link (same factor type)
- D.Two separate usernames from different directories
Why B is correct
MFA requires factors from at least two different categories: knowledge (password/PIN), possession (hardware token, smart card, TOTP app), or inherence (fingerprint, face ID). Password + TOTP (time-based one-time password) is the most common remote access implementation. Two passwords (option A) are both knowledge factors -- same category, not MFA. Email confirmation (option C) is a second step but typically another knowledge/possession factor depending on how email is secured. Two usernames (option D) have no authentication value at all.
Know someone studying for Network Fundamentals? Send them this one.