220-1102 Question 375
Single answerPasswordless/Windows HelloA company is deploying Windows 11 laptops to sales staff and wants to reduce password-related help desk calls. A user says they want to sign in without typing a password, but they do not want their fingerprint stored on a company server. The laptop has an IR camera and is joined to Microsoft Entra ID (Azure AD). Which authentication method should the technician recommend?
- A
Enable Windows Hello for Business facial recognition on the laptop
- B
Configure the user to sign in with a shared local account and a short PIN
- C
Require the user to use a smart card for every sign-in
- D
Disable passwords entirely and allow automatic sign-in with the cached domain credential
Show answer and explanation
Correct answer: A
Explanation
The best answer is Windows Hello for Business facial recognition. In Windows 10 and Windows 11, Windows Hello and Windows Hello for Business provide passwordless sign-in methods such as facial recognition, fingerprint recognition, and PIN. The biometric templates are stored locally in a protected manner on the device, typically with support from the TPM, rather than storing raw biometric data on a server. This makes Windows Hello a practical option for organizations that want to improve usability and reduce password resets while maintaining security. Microsoft documentation for Windows Hello and Windows Hello for Business describes device-bound credentials, local biometric storage, and passwordless sign-in as key design elements and best practices.
- A. Correct.
Correct. Windows Hello for Business supports passwordless sign-in using facial recognition with a compatible IR camera. Biometric data used by Windows Hello is stored securely on the device, not sent to a central server as a raw fingerprint or facial image. This matches the user's concern about not storing biometric data on a company server while still providing passwordless authentication.
- B. Incorrect.
Incorrect. A shared local account is not an appropriate business security practice because it removes accountability and weakens access control. In addition, a short PIN by itself on a shared account does not provide the intended user-specific Windows Hello for Business protection.
- C. Incorrect.
Incorrect. Smart cards can support strong authentication, but the scenario specifically points to a device with an IR camera and a user who wants a convenient passwordless option. A smart card may work, but it is not the best recommendation based on the stated requirements and available hardware.
- D. Incorrect.
Incorrect. Automatic sign-in with cached credentials is not an appropriate secure replacement for interactive authentication. Cached credentials are used to allow previous users to sign in when a domain controller is unavailable, not to bypass sign-in security controls.