Which control helps mitigate phishing beyond training and awareness?

• A. Disabling email filtering
• B. Multi-factor authentication
• C. Sharing passwords with teammates
• D. Using single-factor authentication

Answer: (B)

Multi-factor authentication adds a second factor to prove who you are, so even if a phisher steals your password, they still can’t sign in without the additional factor. The second factor might be a one-time code from an authenticator app, a hardware security key, a biometric check, or another method that the attacker doesn’t possess. This substantially reduces the impact of credential theft because login requires something you have or are in addition to something you know. Disabling email filtering would make phishing easier, sharing passwords is insecure and undermines controls, and relying on a single factor leaves accounts vulnerable to credential theft via phishing.