Multifactor Authentication for Security+
Short answer
The exam skill is to choose the multifactor authentication (MFA) method that fits the risk and use case. Remote access, administrative access, cloud consoles, and sensitive data access usually justify stronger MFA. Software authenticators are easy to deploy but can be weaker if push fatigue or device compromise is a concern. Hardware tokens and security keys are stronger for privileged users and high-risk access because the user must possess a separate device. Biometrics are convenient and difficult to share, but they require enrollment, privacy consideration, and fallback handling.
Why it appears on the exam
SY0-701 4.6: Match MFA factors and implementations such as biometrics, tokens, security keys, and location to authentication scenarios.
Key concepts
Concept 1
Required terms
multifactor authentication: authentication that requires evidence from two or more different factor categories. authentication factor: a category of evidence used to prove identity, commonly something you know, have, are, somewhere you are, or something you do. biometrics: authentication based on a physical or behavioral trait, such as fingerprint, face, iris, voice, or keystroke pattern. hardware token: a physical device that provides authentication evidence, such as a one-time password generator or smart card.
Example
A company wants phishing-resistant protection for cloud administrators. A security key is the best match because possession is required and the authentication can be bound to the legitimate service.
Concept 2
How Multifactor Authentication works
The exam skill is to choose the MFA method that fits the risk and use case. Remote access, administrative access, cloud consoles, and sensitive data access usually justify stronger MFA. Software authenticators are easy to deploy but can be weaker if push fatigue or device compromise is a concern. Hardware tokens and security keys are stronger for privileged users and high-risk access because the user must possess a separate device. Biometrics are convenient and difficult to share, but they require enrollment, privacy consideration, and fallback handling.
Example
A remote employee logs in with a password and approves a prompt in an authenticator app. This combines knowledge and possession, so it is MFA.
Concept 3
Common confusion
The common mistake is counting two examples from the same factor category as MFA. A password plus a PIN is still knowledge plus knowledge. MFA requires different categories, such as password plus token or smart card plus biometric.
Example
A laptop unlocks with a fingerprint. The biometric is an inherence factor; if a password is also required, the login uses two factor categories.
Concept 4
What to recognize
Identify whether a scenario uses true MFA or only multiple same-factor checks; Match biometrics, hardware tokens, software tokens, security keys, out-of-band verification, or location-aware checks to a risk scenario; Choose stronger MFA for administrators, remote access, or high-value systems; Recognize enrollment, recovery, and token revocation as MFA maintenance tasks.
Example
A user is blocked because the login originates from a new country at an unusual hour. Location is being used as a conditional or adaptive signal, not as a replacement for all authentication.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.A security team sees this situation: A company wants phishing-resistant protection for cloud administrators. Which concept applies?
Q2.A security question includes this clue: A remote employee logs in with a password and approves a prompt in an authenticator app. This combines knowledge and possession, so it is MFA. Which term is being tested?
Q3.For this Security+ objective, the scenario says: A laptop unlocks with a fingerprint. The biometric is an inherence factor; if a password is also required, the login uses two factor categories. Which concept should you choose?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8