Cloud administrators use SMS one-time codes as their second factor for console sign-in. Several recent attacks used fake sign-in pages that relayed both the password and the SMS code to the real console in real time. Which MFA change best defends against this attack?
Select an answer to reveal the explanation.
Short Explanation
A phishing proxy just passes your code along to the real site faster than you can blink, so any code you type is up for grabs. FIDO2 security keys check which website is actually asking and refuse to answer a fake one. That's why authenticator apps and push prompts aren't enough here; you can still be tricked into handing them over.
Full Explanation
Real-time phishing proxies sit between the victim and the legitimate service, forwarding credentials and one-time codes instantly and capturing the resulting session. Any factor that a human reads and types, or approves without context, can be relayed. FIDO2 and WebAuthn authenticators use public key cryptography in which the authenticator signs a challenge bound to the origin of the site requesting it; a look-alike domain receives a credential that is useless at the real site, or no response at all, so the attack fails regardless of user judgment. That property is why these authenticators are described as phishing resistant. Authenticator apps generating time-based codes remove SMS interception risks such as SIM swapping, but users can still type the code into a fake page, which the proxy relays. Push notifications can be relayed the same way and add the risk of MFA fatigue, where users approve repeated prompts. Shortening code validity does little because the relay happens within seconds. Exam caveat: privileged and management plane access is where phishing-resistant MFA should be required first. Operational check: confirm administrative roles are enforced to authenticate only with FIDO2 authenticators and that fallback to SMS is disabled for those accounts.