Question 844 of 1,013
SY0-701 General Security Concepts Practice Question
Exhibit
Remote Access Security Requirement Must have all of the following: - Phishing-resistant second factor - Works without relying on SMS or email delivery - Suitable for privileged administrator logons Available methods under review: 1. SMS one-time code 2. Email one-time link 3. Authenticator app TOTP code 4. FIDO2 hardware security key
Based on the exhibit, which authentication method best meets the stated remote-admin requirement?
⚠ Common exam trap
Many exam-takers choose TOTP (Option C) because it is a common second factor, but they overlook that the question specifically requires phishing resistance, which TOTP does not provide against modern adversary-in-the-middle attacks, whereas FIDO2 does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.
The remote-admin requirement emphasizes phishing resistance and independence from SMS or email delivery, which are vulnerable to interception or social engineering. FIDO2 hardware security keys use public-key cryptography and origin-bound credentials, making them phishing-resistant and eliminating reliance on potentially compromised communication channels. This aligns with the stated requirement better than the other options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SMS one-time code, because it is widely supported and easy for users to adopt.
Why it's wrong here
While SMS one-time codes are convenient and provide an additional authentication factor, they are not phishing-resistant because the SMS channel can be compromised via SIM-swapping attacks, where an attacker asks the carrier to port the victim's number to a device they control. Even without porting, the code can be intercepted by malicious apps with SMS permission or through signaling system vulnerabilities, and a real-time relay can forward the one-time code to the legitimate site to defeat the second factor. NIST SP 800-63B now deprecates SMS for out-of-band verification, underscoring that it is unsuitable for privileged administrator authentication.
- ✗
Email one-time link, because it can be delivered to any mailbox quickly.
Why it's wrong here
Email one-time links are functionally tied to the security of the mailbox infrastructure and the user's email account, not to a dedicated phishing-resistant device or possession factor. An attacker who gains access to the mailbox, or who is positioned to intercept email in transit, can click the link or extract the embedded token and authenticate as the user without their consent. Additionally, an email link can be manually forwarded by the user under a phishing duress scenario, and it does not cryptographically bind the authentication request to the legitimate destination, so it fails the requirement for a phishing-resistant factor.
- ✗
Authenticator app TOTP code, because it adds a second factor without special hardware.
Why it's wrong here
TOTP authenticator apps add a true possession factor because the secret key is stored on the user's device, but they lack origin binding, meaning the one-time code is not cryptographically tied to the specific website or application being accessed. An adversary-in-the-middle proxy, such as a real-time phishing kit that simply mounts a live relay, can capture the user's username and password, ask the user for the current TOTP code, and replay it to the legitimate site within the 30-second validity window, successfully authenticating as the user. This vulnerability to real-time intercept and replay is precisely why TOTP is considered a legacy second factor and is not classified as phishing-resistant for privileged access.
- ✓
FIDO2 hardware security key, because it resists phishing and does not depend on SMS or email delivery.
Why this is correct
The requirement explicitly calls for a phishing-resistant factor that does not depend on text messages or email. A FIDO2 hardware security key meets that need and is well suited for privileged administrator authentication because it strongly binds the login to the legitimate site.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.