Finance staff reach the treasury network over VPN using passwords alone. Which authentication strategy change is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Password-only VPN into treasury is a single lock on a vault door. Add MFA—or move toward phishing-resistant passwordless—so stolen passwords alone do not open the books. Faster logins, quieter logs, and shared chat passwords push risk the wrong way.
Full Explanation
Authentication, authorization, and accounting for sensitive remote access—such as finance staff reaching the treasury network over VPN—should not rest on a single memorized password. Strengthening AAA with multifactor authentication or phishing-resistant passwordless methods raises assurance so a stolen or phished password alone does not open treasury systems. Logged, authorized sessions then bind actions to strongly authenticated identities rather than a shared or weak secret.
Keeping password-only VPN because users prefer shorter login times subordinates treasury risk to convenience. Removing accounting or audit logs for VPN sessions “to simplify compliance packs” destroys evidence needed for investigations and genuine compliance. Publishing a shared finance VPN password in team chat maximizes credential reuse and eliminates individual accountability.
Exam caveat: high-value remote paths are classic MFA use cases; single-factor VPN into finance/treasury is a frequent wrong answer. Operational check: enforce MFA (or passwordless) on finance VPN, ban shared VPN secrets, retain AAA logs for remote sessions, and verify treasury network access still requires the strengthened authenticator every time.