SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Increase password complexity requirements

  Why it's wrong here

  Increasing password complexity does not mitigate MFA push-bombing because the adversary already possesses valid credentials through prior phishing, credential stuffing, or stealer malware. The attack exploits user fatigue and social engineering to approve a genuine one-time prompt, not weak password hashes. Password entropy only raises the barrier for offline cracking; it has no bearing on the authentication approval step, so the attacker's present hold on the account remains unchanged.

• ✓

  Use phishing-resistant MFA with number matching or hardware security keys

  Why this is correct

  Phishing-resistant MFA with number matching (e.g., conditional access policies that require entering the displayed number in the authenticator) or hardware security keys (FIDO2/WebAuthn) makes blind push approvals impossible. Number matching forces the user to compare an out-of-band code on the device against the one on the login screen, so an attacker spamming prompts cannot receive an approval without that matching code. Hardware keys cryptographically bind authentication to the exact origin and require user presence, preventing relay and prompt fatigue entirely, because the key simply will not sign a request the user does not physically tap for that specific site.

• ✗

  Shorten the screen-lock timeout on user devices

  Why it's wrong here

  Shortening the screen-lock timeout only reduces the window for physical takeover of an unlocked device; it does not prevent the user from unlocking and approving a malicious MFA prompt while actively using the phone or laptop. The MFA push spam arrives as a notification and the user is tricked into hitting approve by the attacker’s repeated requests or a disguised support call, not because the device screen was left unlocked. Tightening screen lock might stop a co-worker from picking up an unlocked phone, but it leaves the psychological manipulation of the authorized user untouched, so the attack chain remains viable.

• ✗

  Allow users to approve any MFA prompt sent during business hours

  Why it's wrong here

  Allowing approval of any MFA prompt during business hours does not verify the user’s intent or correlate the request with an actual IT-initiated password reset. The attack succeeds because the adversary sends unsolicited prompts and then socially engineers approval; this option would still permit approval of those prompts without requiring a matching out-of-band confirmation, such as a number-matching challenge. It is tempting because it reduces friction for legitimate support workflows, and would be correct in a scenario where the sole threat is prompt fatigue outside working hours, not a combined social-engineering and push-spam attack.