Which TWO of these statements about authentication methods are true?
Microsoft Certified: Azure Fundamentals (AZ-900), objective architecture-and-services. Azure architecture and services hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
The options
Choose 2.
Correct Multifactor authentication combines factors from different categories — something you know, something you have, something you are — so two passwords do not qualify
True. The strength comes from the categories being independent: stealing a password does not also steal a phone or a fingerprint, whereas stealing one password often reveals the habits behind the second.
Correct Passwordless methods such as a device sign-in, a hardware security key or an authenticator app remove the password from the sign-in rather than adding a step to it
True, and that is their point: a credential that is never typed and never reused cannot be phished or replayed the way a password can.
Not correct Single sign-on means each user has one password per application, saved in the browser
False. Single sign-on means one authentication with a central identity provider grants access to many applications. Passwords in a browser are the situation it replaces.
Not correct Enabling multifactor authentication removes the need for Conditional Access because every sign-in is already strong
False. Multifactor authentication is a control; Conditional Access is what decides when that control is demanded and what else must hold — device state, location, risk — before a sign-in succeeds.
Not correct Single sign-on requires each application to keep its own copy of the user's credentials
False, and it is the reverse of the benefit. Fewer systems holding credentials means fewer places to breach and one place to disable an account when somebody leaves.
Why
Single sign-on concentrates authentication in one identity provider, which reduces both password sprawl and the number of doors to secure — and makes strengthening that one door correspondingly important. That is why multifactor and passwordless methods matter: the first adds an independent category of proof, the second removes the weakest credential entirely. Conditional Access is the layer that decides when each is required.
Where this comes from
- Cited
- Microsoft AZ-900 study guide skill area architecture-and-services.identity-access-security
Practise this
Reading one question is not practice. The trainer will draw a set from objective architecture-and-services and space the ones you get wrong.
Practise Microsoft Certified: Azure Fundamentals (AZ-900)
More questions on this objective
- An image-resizing routine runs for about two seconds whenever a file lands in a storage container — perhaps two hundred times on a busy day, and not at all on a quiet one. The team wants to pay for the work done and maintain no servers. Which compute option fits? machine-checked
- A fifteen-year-old accounting application needs a kernel-level driver, a scheduled task that edits the registry, and a runtime version nobody supports any more. The business wants it running in Azure this quarter with as few code changes as possible. Where does it go? machine-checked
- A team runs nine small services, each with its own conflicting library versions. They want each one packaged with its dependencies, starting in seconds, several to a host, without a separate operating system per service. Which compute type are they describing? machine-checked
- Which TWO of these statements about Azure compute types are true? machine-checked
- A public website runs on four identical virtual machines behind a load balancer. Traffic triples while a television advert airs and falls back an hour later. The team wants instances added and removed automatically against CPU, all built from one image, with nobody clicking. Which option is designed for that? machine-checked
- Three virtual machines form a quorum-based cluster in a region that has no availability zones. You want them placed so that neither a single rack losing power nor a single batch of planned host maintenance can take all three at once. What do you configure? machine-checked