Skip to content
AI Security

Interview question · Identity, OAuth & Access Control

Attackers keep getting in by calling your IT help desk and asking for an MFA reset. How do you redesign account recovery?

Phishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.

hardNewPreparation tags: Microsoft, Google, CrowdStrikeUpdated Nov 2026

Phishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 5 follow-ups like an interviewer would

An IT help desk resets MFA after the caller answers three questions: employee ID, manager's name and date of birth. A red-team exercise succeeded on four of five calls, including one for a cloud administrator.

  1. Why did the questions fail as verification?
  2. What verification would stop the calls?
  3. What if verification is fooled anyway?
  4. Why did the cloud administrator reset succeed?
  5. What does the redesigned recovery look like?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackHow can a website tell that a request really comes from a specific AI agent or crawler? Explain signed requests and Web Bot Auth.Next in this trackWhat is device code phishing, why does it beat ordinary MFA and URL checks, and how do you shut it down in Entra ID or Google Workspace?Next in this trackA vendor connected to your CRM is breached and its OAuth tokens are stolen. How do SaaS-to-SaaS breaches work, and how do you respond?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.