Attackers using real-time phishing proxies have captured employees' passwords and the one-time codes from their authenticator apps. The organization wants an authentication method that a look-alike site cannot capture and replay. Which option BEST meets this goal?
Select an answer to reveal the explanation.
Short Explanation
A phishing proxy just relays whatever you type - password, code, anything. Passkeys don't give it anything to relay, because the credential is tied to the real site's name and the private key never leaves your device. SMS codes are typed in too, so they get relayed just like the authenticator codes.
Full Explanation
Passkeys are passwordless credentials based on public key cryptography. During registration, the user's device creates a key pair bound to the legitimate site's origin; the private key stays on the device or in its secure storage, and the site keeps only the public key. At sign-in, the authenticator signs a challenge only for the origin it was registered with, so a look-alike domain cannot obtain a valid response, and there is no shared secret for the user to type and an attacker to replay. That directly defeats real-time phishing proxies. SMS one-time passwords are typed into the page like authenticator codes, so a proxy relays them just as easily, and SMS adds risks such as interception and SIM swapping. Longer, more complex passwords with frequent rotation do not change the fact that a phished password is captured in full; rotation also tends to produce predictable patterns. Security questions are another typed secret, often guessable or discoverable, and are relayed by the same proxy. Exam caveat: phishing resistance comes from origin binding and the absence of a transferable secret, not simply from having two factors. Operational check: pilot passkeys for high-risk groups, then confirm that legacy fallback methods such as SMS are restricted so attackers cannot downgrade.