ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Virtual MFA applications such as Google Authenticator or Authy generate time-based one-time passwords on a registered smartphone. Because the phone is in the user's possession, the OTP represents a possession ("have") factor that, when combined with the existing password, forms MFA. Enforcing a stronger password policy or rotation schedule still relies on a single "know" factor, so it does not meet MFA requirements. IP allow lists restrict where authentication can originate but do not add a second factor. Challenge questions only introduce another knowledge factor and can be easily guessed or mined from social media. Therefore, enabling virtual MFA devices for each IAM user is the only option that introduces the required "have" factor without purchasing and distributing hardware tokens.