Which MFA configurations are considered secure, and what fallback methods should be prepared?

• A. Use only SMS-based codes.
• B. MFA configurations should require MFA for sensitive actions; authenticator apps, hardware tokens, or FIDO2; avoid SMS; have backups like recovery codes.
• C. MFA is optional for all users.
• D. Disable backups.

Answer: (B)

Secure MFA relies on strong, phishing-resistant second factors and plans for when a factor isn’t available. Relying on SMS is risky because codes can be intercepted,SIM-swapped, or ported to another user, so it’s not considered a secure stand-alone factor. The best configurations use authenticator apps, hardware tokens, or FIDO2 keys, which generate codes locally or use public-key cryptography and aren’t easily phishable or intercepted. Requiring MFA for sensitive or privileged actions adds an extra layer of protection, so even if a password is compromised, critical operations still require a second form of verification.

Backups and recovery are essential. Have recovery codes or other secure fallback methods so users aren’t locked out if their primary factor is unavailable. This can include a secondary authenticator, a backup hardware token, or secure offline recovery options. In short, a secure setup uses modern, resistant second factors, enforces MFA for high-risk actions, and includes reliable recovery options.