After a phishing attempt targeted several NOC staff, the utility's CISO wants FortiGate administrator logins to require something beyond just a correct password before granting access, so a stolen password alone is not enough to log in. Which account-level feature should the team enable to meet this requirement?
Select an answer to reveal the explanation.
Short Explanation
A stolen password only proves someone typed the right string, not that they're the right person. Add two-factor authentication and the login also needs a one-time code or push approval that a phishing email can't hand your attacker, so the password alone stops being enough.
Full Explanation
FortiGate administrator accounts can be configured to require two-factor authentication, typically a time-based token or a push notification, in addition to the username and password. Because the second factor is generated on or approved from a separate device the attacker does not control, a password obtained through phishing is no longer sufficient on its own to complete a login, which is exactly the CISO's stated requirement. A longer minimum password length policy raises the difficulty of guessing or brute-forcing a password, but it does nothing to stop a password that has already been captured directly through phishing from being reused successfully. A shorter idle timeout reduces the window an already-authenticated session stays open if left unattended, but it has no effect on whether a stolen credential can be used to authenticate in the first place. Restricting the account to a read-only access profile limits what an attacker could do after a successful login, but it does not prevent the login itself, and a phished account could still expose sensitive read-only data such as configuration and log details. To confirm the control is active, attempt to log in with only the correct password and verify the FortiGate prompts for the second factor before granting access.