Multi-factor authentication (MFA) can reduce the risk that a stolen password alone is enough to access a remote-access VPN.

### Why this is right\nMFA requires another authentication factor in addition to a password, so possession of the stolen password alone may not be sufficient.\n\n### The concept\nRemote-access VPNs authenticate clients to a service. User identity can help restrict what the client may reach. MFA adds a further check to the login process, but it does not eliminate every risk or replace endpoint security and access policies.\n\n### Terms\n- **MFA**: Multi-Factor Authentication, a login process requiring more than one kind of proof.\n- **VPN**: Virtual Private Network, a protected tunnel across another network.\n\n### Remember\nMFA strengthens authentication; it does not make a VPN endpoint invulnerable.