A phishing campaign tricks several employees into entering their passwords on a fake portal, yet the attackers fail to sign in to the real applications with those passwords. Which control most likely produced this outcome, and which form of it best resists an attacker who relays the login in real time?
Select an answer to reveal the explanation.
Short Explanation
A stolen password is only half a key when MFA guards the door. But real-time phishing kits can relay codes too, so you want phishing-resistant MFA like FIDO2, which checks it's talking to the genuine site. Don't be fooled by complexity rules — a long password is just as stealable.
Full Explanation
Multifactor authentication requires something beyond the password, such as a possession factor or biometric, so a captured password alone does not complete a sign-in. That explains why the attackers failed. However, attacker-in-the-middle phishing kits can proxy the entire login in real time, capturing one-time codes or push approvals and the resulting session cookie. Phishing-resistant authenticators such as FIDO2 security keys and platform passkeys defeat this because the cryptographic challenge is bound to the origin; a credential registered for the real domain will not answer a request from a look-alike domain. Password complexity improves resistance to guessing but does nothing once a user types the password into a fake page. Account lockout limits repeated guessing, while the attackers here held the correct password, so lockout would not trigger. Single sign-on centralizes authentication, which simplifies enforcement of MFA, but without a second factor a stolen password simply works at the single identity provider for every connected application. Exam caveat: SMS and one-time codes are better than passwords alone but are not phishing-resistant. Operational check: review sign-in logs for the targeted users, confirm MFA blocked the attempts, and prioritize FIDO2 enrollment for administrators and finance staff.