I am preparing for the CISA exam and come across material saying "challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks". But the material doesn't mention which kind of authentication is strong against MiTM attacks.
According to my understanding, the above statement is not very meaningful because all types of authentication are prone to MiTM.
To prevent MiTM, we can apply more than single factors for authentication. For instance, beside a login from the browser, the user might also need to press the confirm button on the mobile app within a minute in order to complete authentication. However, there is a single authentication method not prone to MiTM. Am I correct?