220-1102 Practice Question: Experiencing a security incident where an…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Require a complex password with a minimum length of 20 characters

  Why it's wrong here

  While requiring a complex password with a minimum length of 20 characters strengthens the 'something you know' authentication factor, it does not introduce a second, distinct factor. This approach primarily makes brute-force attacks more difficult but leaves the system vulnerable if the single password is compromised through other means, such as phishing or keylogging, as there is no additional layer of security beyond that single credential.

• ✓

  Implement a time-based one-time password (TOTP) via an authenticator app

  Why this is correct

  Implementing a time-based one-time password (TOTP) via an authenticator app significantly enhances security by introducing a second, independent authentication factor ('something you have'). This method generates a unique, ephemeral code that changes typically every 30-60 seconds, which must be entered in addition to the user's password. Even if an attacker compromises the user's password, they cannot gain access without also possessing the physical device generating the current TOTP code, making credential reuse extremely difficult.

• ✗

  Restrict VPN access to specific IP addresses

  Why it's wrong here

  Restricting VPN access to specific IP addresses (IP whitelisting) is a network access control measure that limits where connections can originate from, enhancing perimeter security. However, it is not an authentication factor itself. An attacker operating from an allowed IP address, or spoofing one, could still potentially gain access if they compromise the user's single authentication factor (e.g., password), as this control does not add a second layer to the authentication process.

• ✗

  Enable single sign-on (SSO) with Active Directory

  Why it's wrong here

  Enabling Single Sign-On (SSO) with Active Directory streamlines the user experience by allowing users to authenticate once and gain access to multiple services without re-entering credentials. While convenient, SSO primarily centralizes and simplifies the 'something you know' (password-based) authentication process. It does not inherently introduce a second, distinct authentication factor; if the initial SSO credential (the user's Active Directory password) is compromised, an attacker could potentially access all integrated services.

Go deeper

Related to this question