The correct answer is to implement risk-based adaptive MFA that prompts only when anomalous activity is detected. This solution directly addresses the tension between usability and security by evaluating contextual factors—such as location, device, time, and behavior—to calculate a risk score for each authentication attempt. When the risk score is low, the system skips the OTP challenge, allowing traders seamless access during high-pressure market hours; only when anomalous activity is detected does it trigger the additional factor, preserving strong security without unnecessary friction. On the CISSP exam, this scenario tests your grasp of adaptive authentication within the Identity and Access Management domain, specifically how to balance security controls with operational efficiency. A common trap is choosing to simply reduce the OTP timeout or increase failed-attempt thresholds, which weakens security. Remember the memory tip: “Adaptive MFA adapts to the risk, not the user’s patience.”
CISSP Identity and Access Management Practice Question
This CISSP practice question tests your understanding of identity and access management. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial services firm recently deployed a multi-factor authentication (MFA) solution for remote access to its trading platform. The MFA requires a one-time password (OTP) via a mobile app, in addition to a username and password. Since deployment, remote traders have complained that the authentication process takes too long, especially during market open hours. The help desk reports that many traders are accidentally locking their accounts due to multiple failed OTP attempts. The security team wants to maintain strong security but improve user experience. Which action should the security team take?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement risk-based adaptive MFA that prompts only when anomalous activity is detected
Option C is correct because risk-based adaptive MFA evaluates the context of each authentication request (e.g., location, device, time, behavior) and only triggers an OTP challenge when the risk score exceeds a threshold. This reduces friction for legitimate traders during peak hours while maintaining strong security against anomalous access attempts, directly addressing the complaint of slow authentication without weakening the overall security posture.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Reduce MFA to two factors by removing the OTP requirement
Why it's wrong here
This reduces security and still requires a second factor (e.g., SMS) every time.
✗
Remove MFA requirements during peak hours to improve performance
Why it's wrong here
This would significantly weaken security during critical times.
✓
Implement risk-based adaptive MFA that prompts only when anomalous activity is detected
Why this is correct
Adaptive MFA balances security and user experience by requiring additional factors only when risk is elevated.
Related concept
Read the scenario before looking for a memorised answer.
✗
Extend the OTP validity window to 10 minutes to reduce time pressure
Why it's wrong here
Longer OTP validity increases the window for reuse in attacks and does not address the number of MFA prompts.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may assume extending the OTP validity window (Option D) is a harmless usability fix, but CISSP tests the understanding that longer OTP windows increase the risk of replay attacks and violate the principle of short-lived credentials, whereas adaptive authentication is the correct balance of security and usability.
Detailed technical explanation
How to think about this question
Risk-based adaptive MFA typically uses a policy engine that evaluates signals such as geolocation, device fingerprint, time of day, and historical user behavior to compute a risk score (e.g., 0–100). If the score is below a configurable threshold (e.g., 30), the user is granted access without additional factors; if above, an OTP or other step-up authentication is enforced. In practice, this can be implemented using standards like RADIUS with vendor-specific attributes or via SAML/OpenID Connect claims, and it requires careful tuning to avoid false positives that could lock out legitimate users during market open hours.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Identity and Access Management — This question tests Identity and Access Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Implement risk-based adaptive MFA that prompts only when anomalous activity is detected — Option C is correct because risk-based adaptive MFA evaluates the context of each authentication request (e.g., location, device, time, behavior) and only triggers an OTP challenge when the risk score exceeds a threshold. This reduces friction for legitimate traders during peak hours while maintaining strong security against anomalous access attempts, directly addressing the complaint of slow authentication without weakening the overall security posture.
What should I do if I get this CISSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.