Exams / CLF-C02 / Authentication and federation / Question 1
CLF-C02 practice question: Authentication and federation (1 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company is choosing multi-factor authentication (MFA) devices for its administrators. AWS recommends phishing-resistant MFA where possible. Which TWO options are phishing-resistant? (Choose two.)
Choose two answers.
- AA. A virtual authenticator app that shows a six-digit code
- BB. A FIDO security key plugged into the computer
- CC. A longer, more complex password
- DD. A passkey stored on the user's device
- EE. A security question that only the administrator knows the answer to
Show the answer and explanation
Answers: B, D
- A. Wrong: An authenticator app adds a second factor, but a user can be tricked into typing the code into a fake sign-in page, so it is not phishing-resistant.
- B. Right: Correct. FIDO security keys are bound to the real website, so a fake page cannot reuse the response. AWS lists them as phishing-resistant.
- C. Wrong: A strong password is still a single factor and can be stolen by a phishing page. It is not MFA at all.
- D. Right: Correct. Passkeys are based on FIDO standards and are recommended by AWS as a phishing-resistant option.
- E. Wrong: A security question is another thing the user knows, so it is not a second factor and can be phished like a password.
Explanation
IAM best practices say to require MFA and to prefer phishing-resistant options such as passkeys and security keys. These use FIDO standards that tie the sign-in to the genuine AWS site, so a fake site cannot capture a reusable code. Time-based codes from an authenticator app are still MFA, but a user can be tricked into handing them over.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.