SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Require password changes every 30 days for all users.

  Why it's wrong here

  Frequent password changes every 30 days do not stop an attacker who has already harvested the CEO's password via a phishing page, as they can use the captured credential immediately or within the current validity window. Moreover, if the attacker has already established an authenticated session (e.g., stolen session cookie), changing the password may not invalidate that session, leaving the access intact. This policy often drives users to create predictable password variants (e.g., adding a digit or changing case), which can actually weaken overall security against brute-force or password-spraying attacks. Fundamentally, it ignores the real vulnerability: the lack of a robust second factor that resists phishing.

• ✓

  Use phishing-resistant MFA such as FIDO2 or WebAuthn.

  Why this is correct

  Phishing-resistant multifactor authentication is the strongest choice here because it prevents a stolen password from being enough to log in. The attacker already harvested credentials through a fake login page, so a second factor that cannot be easily replayed from another site directly disrupts the attack path. FIDO2 or WebAuthn reduces the value of captured passwords and helps stop account takeover even when users are deceived by convincing impersonation emails. This is a practical defense against credential phishing and replay.

• ✗

  Turn off all external email to eliminate the chance of future messages.

  Why it's wrong here

  Blanket-blocking all external email would prevent some future phishing messages, but it is an extreme, operationally disruptive measure that would sever legitimate communication with clients, vendors, and partners, causing significant business harm. Even if external email is disabled, the attacker who already has the CEO's password could still impersonate the CEO via internal email, a compromised internal account, or by directly logging into the finance team's accounts with the harvested credentials. Additionally, phishing emails can originate from compromised accounts within trusted domains or via lookalike domains that would not be fully neutralized by simply turning off external mail. This approach fails to address the immediate threat of already-stolen credentials and does not add any authentication barrier to misuse.

• ✗

  Use single sign-on without MFA so users authenticate only once.

  Why it's wrong here

  Single sign-on without MFA does not add a second authentication factor, so the attacker who already possesses the stolen password can still authenticate from a new country without any additional verification. This option is tempting because SSO reduces password fatigue and the number of login prompts, which in a different scenario—where the threat is phishing for credentials across multiple services—would limit exposure by centralising authentication to one trusted identity provider like Microsoft Entra ID.

Go deeper

Related to this question