SY0-701 General Security Concepts Practice Question
An employee receives a phone call from someone claiming to be IT and asking for a one-time verification code to "fix" the employee's account. What is the best response?
⚠ Common exam trap
Candidates often think providing the code is harmless because it is 'one-time' or that changing the password is a proactive security measure, but both actions directly hand over authentication secrets to an unverified caller.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Refuse to share the code and report the call through the company's security process.
It follows the principle of never sharing authentication factors, especially one-time verification codes, with anyone over the phone. This scenario is a classic social engineering attack (vishing) where the attacker attempts to bypass multi-factor authentication (MFA) by tricking the employee into revealing a time-based one-time password (TOTP) or similar code. Reporting the call through the company's security process allows the incident to be investigated and mitigates further risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provide the code quickly so the support call can be completed without delay.
Why it's wrong here
Providing the code promptly plays directly into the caller's urgency, which is a classic social engineering trigger. Even if the caller appears to be from IT, legitimate support staff never request the current MFA code, because that code is a secret that authenticates the user to the system; revealing it to anyone, even briefly, lets an attacker replay it within its validity window and bypass the second factor.
- ✓
Refuse to share the code and report the call through the company's security process.
Why this is correct
The safest response is to refuse the request and report it through the organization’s approved security process. One-time codes should never be shared because they can be used to bypass MFA and hijack the account. Reporting the call helps the security team warn others, investigate the attempt, and reduce the chance of a successful attack.
- ✗
Reply to the caller by email with the code and ask them to confirm receipt.
Why it's wrong here
Sending the code by email does not make the disclosure safe; it simply moves the same secret to a different channel. Email is not a cryptographically secure or authenticated channel here, and the email could be intercepted, forwarded, or land in the wrong mailbox. The caller already demonstrated a suspicious request on the phone, so transmitting the code in any form gives the attacker exactly what they need to complete an unauthorized authentication.
- ✗
Change the password immediately and then tell the caller the new password.
Why it's wrong here
Changing your password first does not mitigate the harm of then revealing that new secret to an unverified caller. A legitimate helpdesk would never require the user to disclose a current or newly created password, and doing so grants persistent, continuing access rather than a one-time token. Furthermore, the attacker's original goal was likely the MFA code, so handing over a new password introduces an even larger compromise of the account's confidentiality.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.