Count categories rather than prompts
MFA requires evidence from different factor categories: something known, something possessed, or a biometric characteristic. Two different passwords are still knowledge evidence. A password plus a memorized PIN also remains within that category. The number of screens or prompts is not the factor count. Before drawing a conclusion, name what each described check verifies. If a device merely displays the input box, that fact does not establish a separately verified possession factor.
Interpret passwordless carefully
Passwordless tells you that an account password is not typed; the actual method and verification configuration still matter. Microsoft documents passkey configurations combined with a local biometric or PIN that can serve as MFA. An unspecified passwordless proposal does not establish that configuration. Keep the supported conditional statement separate from the broad category label. When method evidence is absent, write unknown and request the missing configuration rather than confidently labeling the proposal single-factor or multifactor.
Recovery is another requirement
Self-service password reset addresses a forgotten or unusable password under the relevant enabled configuration and registered verification methods. It can let users recover without a help-desk reset. This is not a claim that every tenant, account or administrator automatically has the same recovery capability. Read the prerequisites supplied by the case. Also keep recovery distinct from permission: restoring the ability to authenticate does not supply a missing application or Azure-resource action grant.
Worked example
Fictional teaching case: a volunteer service proposes a “two-step” sign-in using a password followed by a second memorized secret. A reviewer asks whether this establishes different MFA categories. Classify both pieces of evidence before counting the steps: both are knowledge. The result does not meet the stated different-category requirement. A change that introduces separately verified possession evidence would change the analysis; adding another knowledge prompt would not. This conclusion concerns the described factor evidence, not whether every two-step experience uses the same method.
Transfer check
Now change the decision: a fictional organization has enabled SSPR for the relevant user, who registered the required verification methods and then forgot the account password. The user still has an existing application entitlement. Should the planner choose an access review to restore sign-in? Check basis: no. The immediate job is password recovery, for which the stated SSPR conditions are relevant. The continuing application entitlement does not make the password usable, and reviewing that entitlement does not itself reset the password.
Result check
For an authentication conclusion, point to the exact categories evidenced. For a recovery conclusion, point to enablement, registration and the credential problem. Then state the permission boundary separately. These exercises do not configure a method or reset a real password. Difficulty is an editorial estimate; no learner data establishes calibration or a predicted exam score.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Authentication vs. authorization - Microsoft identity platform | Microsoft LearnMicrosoft Entra multifactor authentication overview - Microsoft Entra ID | Microsoft LearnPasskeys (FIDO2) authentication method in Microsoft Entra ID - Microsoft Entra ID | Microsoft LearnSelf-service password reset deep dive - Microsoft Entra ID | Microsoft Learn