Two-factor authentication can be defeated if ________.

• A. the user's computer is compromised
• B. the attacker uses a man-in-the-middle attack
• C. Neither A nor B
• D. Both A and B

Answer: (D)

Two-factor authentication can be bypassed when the attack affects the security of the end-user's environment or how the second factor is delivered. If the user’s computer is compromised by malware, the attacker can capture credentials and observe or intercept the second factor as it’s used, or perform actions on the user’s behalf, effectively defeating 2FA. If a man-in-the-middle attack is possible, the attacker sits between the user and the service, relays credentials and the second factor, or tricks the user into approving a fake authentication, again bypassing the intended separation of factors. Because either scenario alone can undermine 2FA, the statement that it can be defeated in both conditions is the strongest, capturing the idea that endpoint compromise or interception can undermine the second-factor protection.