hardMultiple ChoiceObjective-mapped
CISM Practice Question: During an incident investigation, the team…
During an incident investigation, the team discovers that an attacker used a valid user's credentials to access a sensitive database. The user's account had multi-factor authentication (MFA) enabled. How is this MOST likely possible?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user approved a fraudulent MFA prompt
MFA fatigue attacks (also known as push bombing) involve an attacker repeatedly sending MFA push notifications to the user until the user, annoyed or confused, approves one. This allows the attacker to bypass MFA without needing the token or password. Option A is less likely because MFA was enabled and properly configured; Option B is incorrect because MFA tokens are generated dynamically and cannot be guessed; Option D is possible but not the most likely given the description that a valid user's credentials were used and MFA was enabled, making user approval the weakest link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MFA was not properly configured
Why it's wrong here
Improper config could allow bypass, but the scenario says MFA was enabled.
- ✗
The attacker guessed the MFA token
Why it's wrong here
MFA tokens are time-based and hard to guess.
- ✓
The user approved a fraudulent MFA prompt
Why this is correct
Attackers can bombard users with MFA requests until they approve one.
- ✗
The attacker used a man-in-the-middle attack
Why it's wrong here
MITM can intercept credentials but not bypass MFA without user interaction.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.