Fido2 Security Key 2sv Privileged Accounts

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise uses Cloud Identity to govern administrative access to Google Cloud projects hosting mission-critical workloads. A recent internal red-team assessment demonstrated that threat actors could execute adversary-in-the-middle (AitM) reverse-proxy phishing attacks to intercept session cookies and bypass standard multi-factor authentication methods, such as SMS codes and mobile authenticator push prompts.

The security architect must enforce an authentication policy for all privileged administrators that eliminates credential harvesting and AitM relay attacks.

Which 2-Step Verification (2SV) configuration should the architect implement?

Assign privileged administrators to a dedicated Organizational Unit (OU) and set 2-Step Verification enforcement to 'Any', mandating Time-based One-Time Password (TOTP) authenticator apps.

Enforce Google prompt push notifications with number matching across all administrator mobile devices.

Configure Context-Aware Access policies requiring SMS-based verification codes paired with corporate IP subnet restrictions.

Assign privileged administrators to a dedicated Organizational Unit (OU) and configure the 2-Step Verification policy to enforce 'Only security key' using FIDO2/WebAuthn hardware keys.

Professional Cloud Security Engineer

Fido2 Security Key 2sv Privileged Accounts

Related questions