What is MFA, and why are some MFA methods stronger than others?

What the interviewer wants to hear

• MFA combines different factor types: know, have, are
• Stops most attacks that only use stolen passwords
• SMS and push can be phished, SIM-swapped or fatigued
• FIDO2 keys and passkeys are phishing-resistant because they are bound to the real site

Model answer

Multi-factor authentication asks for at least two different types of proof: something you know, like a password, something you have, like a phone or security key, and something you are, like a fingerprint. It blocks most attacks that rely only on stolen passwords. But methods differ in strength. SMS codes can be stolen through SIM swapping or simply typed into a phishing page. Push notifications can be abused through MFA fatigue, where attackers spam prompts until a user approves, though number matching helps. The strongest options are FIDO2 security keys and passkeys. They use public key cryptography and are bound to the real website domain, so a fake login page cannot use them. For admins and high-risk users, I would push for phishing-resistant methods first.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?