220-1102 Question 327
Single answerBiometricsA company issues Windows 11 laptops that use Windows Hello fingerprint sign-in for field technicians. Several technicians report that after working outdoors in cold weather, their fingerprint sign-in frequently fails even though their PIN still works. The security team wants to keep biometric sign-in enabled but reduce these login failures without lowering security. Which action should the technician recommend FIRST?
- A
Have users clean the fingerprint reader and re-enroll their fingerprints when their hands are in normal condition
- B
Disable Windows Hello and require only passwords for all affected users
- C
Lower the account lockout threshold so repeated fingerprint attempts are less likely to cause delays
- D
Replace fingerprint sign-in with facial recognition on all laptops, even if the devices do not have compatible infrared cameras
Show answer and explanation
Correct answer: A
Explanation
Biometric authentication is convenient, but real-world conditions can affect reliability. For fingerprint readers, dry skin, moisture, dirt, cuts, and environmental changes can reduce successful matches. In Windows Hello deployments, a PIN commonly serves as a fallback authentication method tied to the device, which is why users can still sign in even when fingerprint matching fails. Best practice is to troubleshoot the biometric method first by cleaning the sensor, confirming driver and firmware health if needed, and re-enrolling biometric data when the user is in normal conditions. This preserves security and aligns with practical endpoint support procedures. Microsoft documentation for Windows Hello notes supported sign-in methods and hardware requirements, including the need for compatible hardware for facial recognition and the use of alternative sign-in methods when biometrics are unavailable.
- A. Correct.
This is the best first step. Fingerprint authentication can fail when fingers are cold, dry, dirty, or otherwise different from the condition present during enrollment. Cleaning the sensor and re-enrolling fingerprints under normal conditions is a standard troubleshooting and support practice that preserves security while improving matching reliability. This addresses the real-world issue without removing biometric protection.
- B. Incorrect.
This is incorrect because it removes a supported authentication factor rather than troubleshooting the biometric issue. The scenario specifically says the company wants to keep biometric sign-in enabled. While passwords can be used as a fallback in some environments, disabling Windows Hello entirely is not the best first recommendation.
- C. Incorrect.
This is incorrect because account lockout settings do not fix the underlying biometric matching problem. Also, biometric failures typically fall back to another sign-in method such as a PIN, and changing lockout thresholds could create usability or security issues. It is a policy change unrelated to the likely cause of poor fingerprint recognition.
- D. Incorrect.
This is incorrect because facial recognition requires supported hardware, typically an infrared-capable camera for secure Windows Hello facial authentication. Recommending a company-wide switch on devices that may not have compatible hardware is impractical and does not address the immediate issue. It also introduces unnecessary cost and deployment complexity.