After password-spray attempts against municipal Microsoft 365 accounts, leadership asks for a control that reduces success of password-only attacks. Which method fits?
Select an answer to reveal the explanation.
Short Explanation
Password spray tries many accounts with common passwords. MFA means a guessed password still is not enough. That is why spray incidents push MFA rollouts.
Full Explanation
Multifactor authentication (MFA) reduces the success of password-based attacks, which is the control leadership should adopt after password-spray attempts against municipal Microsoft 365 accounts. Spray attacks thrive when passwords alone gate access; a second factor stops many compromised or guessed passwords from becoming successful sign-ins. For city accounts exposed to internet authentication, MFA is the fundamentals response to password-only risk.
Disabling all audit logs so spray attempts cannot be investigated worsens detection and response. Publishing a public city wiki of commonly used passwords for staff convenience actively helps attackers. Removing Conditional Access so every legacy client can sign in unchecked expands the attack surface rather than reducing password-only success.
An exam caveat is that MFA works best alongside monitoring and Conditional Access restrictions on legacy authentication, but MFA itself is the direct countermeasure named for password-only attack success. Operationally, enforce MFA for targeted municipal users, review Entra sign-in logs for residual spray patterns, and confirm failed password attempts no longer yield successful sessions when the second factor is missing.