hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A financial services firm recently deployed a…
A financial services firm recently deployed a multi-factor authentication (MFA) solution for remote access to its trading platform. The MFA requires a one-time password (OTP) via a mobile app, in addition to a username and password. Since deployment, remote traders have complained that the authentication process takes too long, especially during market open hours. The help desk reports that many traders are accidentally locking their accounts due to multiple failed OTP attempts. The security team wants to maintain strong security but improve user experience. Which action should the security team take?
⚠ Common exam trap
Test-takers frequently assume extending the OTP validity window (Option D) is a harmless usability fix, but CISSP tests the understanding that longer OTP windows increase the risk of replay attacks and violate the principle of short-lived credentials, whereas adaptive authentication is the correct balance of security and usability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement risk-based adaptive MFA that prompts only when anomalous activity is detected
Risk-based adaptive MFA evaluates the context of each authentication request (e.g., location, device, time, behavior) and only triggers an OTP challenge when the risk score exceeds a threshold. This reduces friction for legitimate traders during peak hours while maintaining strong security against anomalous access attempts, directly addressing the complaint of slow authentication without weakening the overall security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce MFA to two factors by removing the OTP requirement
Why it's wrong here
Removing the One-Time Password (OTP) requirement significantly diminishes the overall security posture by eliminating a strong, time-sensitive authentication factor, often representing "something you have." While two factors would still be present, the remaining factors might be less robust or more easily compromised, increasing the attack surface. This approach reduces the cryptographic strength of the authentication process and does not inherently improve user experience if other factors are still always required.
- ✗
Remove MFA requirements during peak hours to improve performance
Why it's wrong here
Eliminating Multi-Factor Authentication (MFA) during peak hours introduces a severe security vulnerability, as these periods often coincide with heightened transaction volumes and increased attractiveness to attackers. This strategy would expose critical financial services data and systems to a greater risk of unauthorized access precisely when they are most active and potentially under the highest load. Sacrificing security for perceived performance gains during critical operational windows is an unacceptable risk management decision.
- ✓
Implement risk-based adaptive MFA that prompts only when anomalous activity is detected
Why this is correct
Implementing risk-based adaptive MFA intelligently balances robust security with user convenience by dynamically assessing contextual factors such as location, device, IP address, and behavioral patterns. This system only triggers additional authentication challenges, like an OTP, when an anomaly or elevated risk is detected, such as a login from an unfamiliar location. This approach maintains strong security controls against sophisticated threats while minimizing user friction during routine, low-risk access attempts.
- ✗
Extend the OTP validity window to 10 minutes to reduce time pressure
Why it's wrong here
Extending the One-Time Password (OTP) validity window to 10 minutes significantly increases the exposure time during which a compromised OTP could be intercepted and potentially replayed by an attacker. This action directly weakens the time-sensitive nature of OTPs, making them more susceptible to various attacks, including man-in-the-middle or session hijacking. Furthermore, it fails to address the fundamental issue of frequent MFA prompts, merely making each individual prompt less secure.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.