Several legacy line-of-business apps still require NTLM-only authentication and thereby block MFA enforcement for those pathways. What should the security program prioritize?
Select an answer to reveal the explanation.
Short Explanation
NTLM-only dinosaurs hold the MFA rollout hostage. Do not pretend NTLM is a security key—put compensating gates around them and schedule the move to modern auth that can actually do MFA.
Full Explanation
NTLM-only legacy line-of-business apps block strong MFA on those pathways and retain relay and credential-theft weaknesses that modern authentication was meant to retire. The security program should inventory those dependencies, apply compensating network and access controls (segmentation, hardened jump paths, restricted source hosts), and drive migration toward protocols that support phishing-resistant MFA. Planning compensated controls plus modernization is the honest prioritization for municipal estates that cannot rip-and-replace overnight.
Declaring NTLM equivalent to FIDO2 for compliance paperwork falsifies assurance and leaves real protocols unchanged. Exposing NTLM directly to the Internet to simplify remote access advertises a weak authentication surface to the world. Disabling MFA globally so legacy and modern apps “behave the same” levels security downward and punishes systems that already support strong factors.
Exam caveat: legacy protocol questions reward migration roadmaps and compensations, not paperwork equivalence or MFA rollback. Operational check: ban NTLM at the Internet edge, constrain it to known app servers, track migration milestones with application owners, enable modern auth and MFA as each app graduates, and re-test relay resistance after protocol changes.