Multifactor Authentication and Least Privilege CSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A cloud administrator is reviewing IAM policies. They notice that a user has full administrative access but only needs to manage virtual machines. What should the administrator do to align with least privilege?

   • AReplace the administrative role with a custom role that only allows VM management
   • BRemove all permissions from the user
   • CKeep the administrative role but require MFA
   • DAssign the user a read-only role
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large organization is rolling out MFA to all employees. They have a significant number of users who are not tech-savvy and often work from personal devices. The security team wants to ensure high adoption while maintaining security. They are considering a phased rollout. Which approach is most effective?

   • AStart with a pilot group of tech-savvy users, gather feedback, then gradually roll out to all users with training and support
   • BOffer MFA as optional for all users
   • CUse only SMS MFA because it is familiar to users
   • DImmediately enforce MFA for all users with no training or support
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A multinational company is implementing MFA for all cloud users. They have offices in several countries and a large remote workforce. The security team is concerned about the reliability of SMS for users in regions with poor cellular coverage. They also want to avoid vendor lock-in. Which MFA strategy is most appropriate?

   • AUse email one-time codes as the primary method
   • BUse SMS as the primary method because it is universally supported
   • CUse push notifications only, as they work over Wi-Fi
   • DUse TOTP authenticator apps as the primary method, with hardware security keys for high-risk users
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization is implementing MFA for a large user base. The security team wants to reduce the risk of push notification fatigue, where users accidentally approve fraudulent login attempts. Which MFA configuration is most effective in mitigating this risk?

   • ASwitch to SMS one-time passcodes
   • BUse push notifications without any additional verification
   • CUse push notifications with number matching, requiring users to match a number displayed on the login screen
   • DDisable MFA for low-risk users to reduce noise
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following scenarios best demonstrates the combined use of MFA and least privilege?

   • AA user logs in with a password and is granted full access to all cloud resources
   • BA user logs in with a fingerprint and is granted administrative rights
   • CA user logs in with a password and is granted access to a single application
   • DA user must provide a one-time code and is then granted read-only access to a specific database
   Reveal Solution Discussion Select an answer first