FortiAuthenticator provides an "emergency code" feature specifically for situations where a user cannot use their primary two-factor authentication method, such as a lost token. An administrator can generate a one-time use code and provide it to the user (e.g., over the phone). The user can then enter this code instead of their regular token code to gain temporary access to the resource. This method maintains security by providing a single-use credential without disabling the 2FA policy.

A. Generate and provide an HOTP to the user: This is incorrect because generating a new HOTP token is part of provisioning a new, permanent token, not providing temporary emergency access.

C. Disable two-factor authentication on the resource: This is a significant security risk. Disabling the policy for all users to solve a single user's temporary issue is an insecure and inappropriate administrative action.

D. Refresh the FTM provisioning status for the user: This action is used to resynchronize a FortiToken Mobile (FTM) application. It is irrelevant if the user's token is lost and does not provide an access code.

1. FortiAuthenticator 6.4 Administration Guide

Page 101

"Emergency codes".

The document states

"Emergency codes are one-time use codes that can be used in place of a FortiToken when a user has lost or forgotten their token. The administrator can enable this feature and provide the user with a code to allow them to log in." This directly supports the use of emergency codes as the correct procedure.

2. FortiAuthenticator 6.2 Administration Guide

Page 91

"Emergency codes".

This guide provides the same explanation: "Emergency codes are one-time use codes that can be used in place of a FortiToken when a user has lost or forgotten their token." This confirms the feature's purpose.