Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How Passwordless Authentication Removes Passwords
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise wants to improve its security posture and reduce helpdesk costs associated with credential resets. The security team decides to eliminate traditional passwords entirely to protect against phishing, credential stuffing, and password spray attacks.
Which authentication method should the organization implement to completely remove passwords from the user sign-in process?
Explanations
Azure Role-Based Access Control (Azure RBAC)
Azure Role-Based Access Control (Azure RBAC)
What Azure RBAC Is
Azure Role-Based Access Control (Azure RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources. It determines what actions a user, group, or service principal can perform on specific subscriptions, resource groups, or individual resources.
Why It Doesn't Meet the Requirement
Azure RBAC is an authorization technology (determining what a user is allowed to do after being authenticated), not an authentication method (determining who the user is). It has no role in managing how users sign in, nor does it replace or eliminate passwords from the sign-in workflow.
Key Characteristics and Limitations
- Authorization Framework: Assigns built-in or custom roles (e.g., Owner, Contributor, Reader) to security principals at defined management scopes.
- Principle of Least Privilege: Ensures users only have the minimal permissions necessary to perform their jobs.
- Independent of Sign-In Method: Relies entirely on the identity provider to authenticate the identity before evaluating RBAC role assignments.
This Answer Would Be Correct If
The organization needed to restrict user permissions so that administrators could only manage specific virtual machines and storage accounts according to the principle of least privilege.
Self-Service Password Reset (SSPR)
Self-Service Password Reset (SSPR)
What Self-Service Password Reset Is
Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that gives users the ability to change or reset their own password without administrator or helpdesk involvement, using predefined verification methods like SMS, email codes, or security questions.
Why It Doesn't Meet the Requirement
SSPR is designed specifically to manage and recover traditional passwords. Rather than eliminating passwords, it keeps passwords in place as the core authentication mechanism. While it helps lower helpdesk ticket volumes for password resets, it does not remove the threat of credential theft, phishing, or password-based attacks.
Key Characteristics and Limitations
- User Empowerment: Allows users to unlock accounts and reset forgotten passwords directly via a secure web portal.
- Password Maintenance: Preserves the traditional password model rather than modernizing away from shared secrets.
- Verification Methods: Relies on out-of-band verification steps (such as mobile phone numbers or the Authenticator app) to authorize the password reset.
This Answer Would Be Correct If
The organization wanted to enable users to independently reset forgotten passwords or unlock their own accounts without contacting the IT support team.
Single Sign-On (SSO)
Single Sign-On (SSO)
What Single Sign-On Is
Single Sign-On (SSO) is an access control mechanism that allows users to authenticate once with a single set of credentials and gain access to multiple connected applications, services, and cloud resources without having to re-authenticate repeatedly.
Why It Doesn't Meet the Requirement
While SSO significantly reduces the number of times users must enter credentials throughout the day, it does not inherently eliminate passwords. In a standard SSO implementation, the primary authentication step can still rely on a traditional username and password, meaning the primary account remains vulnerable to phishing, credential stuffing, and password spray attacks if not coupled with passwordless mechanisms.
Key Characteristics and Limitations
- Centralized Authentication: Authenticates users once at an identity provider (such as Microsoft Entra ID) and issues security tokens to downstream apps.
- Reduced Password Fatigue: Decreases the number of distinct passwords a user must remember, but typically does not remove the underlying master password.
- Single Point of Compromise: If the primary credential is weak or compromised without secondary controls, an attacker gains access to all integrated applications.
This Answer Would Be Correct If
The organization wanted users to sign in once with a single set of credentials to access multiple cloud and on-premises applications without repeated login prompts.
Passwordless authentication
Passwordless authentication
What Passwordless Authentication Is
Passwordless authentication is a modern authentication method that verifies user identity without requiring a traditional password or passphrase during sign-in. Instead of relying on a shared secret stored in a database, it leverages asymmetric public-key cryptography combined with something the user has (such as a device or hardware token) and something the user is or knows locally (such as biometrics or a device PIN).
How It Meets the Requirements
- Eliminating Password-Based Attacks: Because no passwords exist or travel across the network, common threats like phishing, credential stuffing, password spray, and keystroke logging are completely mitigated.
- Reducing Helpdesk Overhead: Organizations experience significantly fewer support tickets related to expired passwords, locked accounts, and manual password resets.
- Strong Identity Verification: Passwordless solutions like Windows Hello for Business, the Microsoft Authenticator app, and FIDO2 security keys fulfill multi-factor authentication (MFA) requirements natively in a single, seamless user step.
Key Advantages and Capabilities
- Phishing Resistance: Standards like FIDO2 / WebAuthn cryptographically bind the credential to the specific domain, preventing users from entering credentials on fake websites.
- Enhanced User Experience: Users sign in faster and more conveniently using biometrics (fingerprint or facial recognition) or a hardware token.
- True Multi-Factor Security: Satisfies two distinct authentication factors (possession of the device/key + biometric/PIN) without typing complex passwords.
- Lower Administrative Costs: Reduces IT helpdesk burdens associated with recurring password maintenance and lifecycle management.
Why This Is Optimal
While other methods manage or protect passwords, passwordless authentication is the only method that completely eliminates the password as a point of failure, providing the strongest protection against credential theft while streamlining the sign-in experience.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Policies
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Single Sign-On
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
FIDO2 Security Keys for Shared Workstations
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
CanNotDelete Resource Lock
Describe the purpose of resource locks
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated