CAS-004 Security Engineering Practice Question
A company is evaluating multi-factor authentication methods. Which TWO are considered phishing-resistant? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIDO2/WebAuthn
FIDO2/WebAuthn uses origin-bound keys, and hardware tokens (e.g., YubiKey) generate one-time passwords or use challenge-response resistant to phishing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
FIDO2/WebAuthn
Why this is correct
FIDO2 uses public key cryptography tied to the origin.
- ✗
Biometric authentication on a smartphone
Why it's wrong here
Biometrics alone are not phishing-resistant; they can be captured or bypassed in some attacks.
- ✗
TOTP via mobile app
Why it's wrong here
TOTP codes can be phished via fake websites.
- ✗
SMS one-time codes
Why it's wrong here
SMS is vulnerable to SIM swapping and phishing.
- ✓
Hardware security tokens (e.g., YubiKey)
Why this is correct
Hardware tokens can be used in challenge-response mode that resists phishing.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.