hardMultiple ChoiceObjective-mapped
FC0-U71 Out-of-band verification Practice Question
A medium-sized business has a policy that requires all employees to use two-factor authentication (2FA) when accessing the corporate email system. The authentication method uses a time-based one-time password (TOTP) app on employees' smartphones. Several employees have reported that they cannot log in because they recently changed phones and did not transfer the TOTP seed. The help desk has been resetting 2FA for these users, but management is concerned about the security of the reset process. Which of the following procedures should the help desk follow to securely reset 2FA for a user?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the user's identity through a separate out-of-band channel, then reset.
Verifying the user's identity through a separate out-of-band channel (e.g., a phone call to a known number or a text message to a previously registered device) ensures the requester is legitimate and prevents unauthorized resets. Option A is wrong because disabling 2FA reduces security and violates the company's policy. Option C is wrong because resetting 2FA upon email request alone is insecure—email can be spoofed or compromised. Option D is wrong because while in-person verification with a photo ID is secure, it is not always practical for remote employees; out-of-band verification provides a good balance of security and convenience.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable 2FA for the user and allow password-only access.
Why it's wrong here
Reduces security for that user.
- ✓
Verify the user's identity through a separate out-of-band channel, then reset.
Why this is correct
Out-of-band verification prevents unauthorized resets.
- ✗
Reset the 2FA immediately upon user request via email.
Why it's wrong here
Email can be compromised or spoofed.
- ✗
Require the user to visit the IT department in person with a photo ID.
Why it's wrong here
Secure but less convenient; out-of-band is sufficient.
Go deeper
Related to this question
About these practice questions
Courseiva writes every FC0-U71 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This FC0-U71 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the FC0-U71 exam.