IncludeHelp_logo
Skip Navigation Links
×

Trending Technologies MCQs

Home » Trending Technologies MCQs

Passwordless Authentication MCQs (Multiple-Choice Questions)

Passwordless Authentication is a security approach that allows users to verify their identities without entering a traditional password. It uses methods such as passkeys, biometrics, hardware security keys, and cryptographic authentication. These Passwordless Authentication MCQs help learners understand passwordless login mechanisms, authentication factors, phishing resistance, WebAuthn, FIDO2, and modern identity security practices.

Passwordless Authentication MCQs

Passwordless authentication reduces reliance on passwords, which can be stolen, reused, guessed, or exposed through phishing attacks and data breaches. Instead, users may authenticate with a device-bound cryptographic credential, a passkey, a security key, or another approved passwordless mechanism.

Practicing these multiple-choice questions helps students, developers, IT administrators, and cybersecurity professionals evaluate their knowledge of passwordless authentication technologies. The questions cover public-key cryptography, biometric verification, passkeys, WebAuthn, FIDO2, authentication challenges, recovery methods, device security, and real-world deployment scenarios.

List of Passwordless Authentication MCQs

The following questions cover passwordless authentication fundamentals, passkeys, FIDO2, WebAuthn, public and private keys, biometric authentication, hardware security keys, magic links, one-time codes, phishing resistance, authentication challenges, account recovery, device registration, and security implementation. Each question includes four options, the correct answer, and an explanation.

1. What is the primary purpose of passwordless authentication?

  1. To remove all security checks from user accounts
  2. To allow users to authenticate without entering a traditional password
  3. To make every account publicly accessible
  4. To eliminate the need to verify user identities

Answer: B) To allow users to authenticate without entering a traditional password

Explanation:

Passwordless authentication replaces traditional password entry with other authentication methods, such as passkeys, security keys, or approved biometric-enabled authentication. The goal is to maintain or improve security while simplifying the sign-in process.

2. Which technology is commonly used to implement phishing-resistant passwordless authentication?

  1. Plain-text passwords
  2. Shared secret questions
  3. Reusable passwords sent by email
  4. FIDO2 and WebAuthn

Answer: D) FIDO2 and WebAuthn

Explanation:

FIDO2 and WebAuthn support public-key-based authentication. Properly implemented passkeys and security keys are bound to the legitimate relying party, helping prevent credentials from being used on phishing websites.

3. What is a passkey?

  1. A digital credential based on public-key cryptography that can authenticate a user without a traditional password
  2. A password written on a physical card
  3. A shared password used by multiple employees
  4. A temporary username assigned by a website

Answer: A) A digital credential based on public-key cryptography that can authenticate a user without a traditional password

Explanation:

A passkey uses a cryptographic key pair associated with an account and relying party. The private key is used to produce an authentication response, while the corresponding public key is registered with the service.

4. Which cryptographic key does a client use to generate a passkey authentication signature?

  1. The server's private key
  2. The server's public key
  3. The client's private key
  4. A public key shared by all users

Answer: C) The client's private key

Explanation:

In public-key-based authentication, the client uses its private key to sign or otherwise respond cryptographically to an authentication challenge. The server uses the registered public key to verify the response without receiving the private key.

5. What information does a server typically store for a public-key-based passkey credential?

  1. The user's private key in plain text
  2. The registered public key and associated credential information
  3. The user's fingerprint image for every login
  4. The password of the user's device

Answer: B) The registered public key and associated credential information

Explanation:

The relying party typically stores the public key and metadata needed to identify and validate the credential. The private key remains under the control of the authenticator or credential-management system and is not sent to the service during normal authentication.

6. What is the primary role of WebAuthn?

  1. To store every user's password in a browser database
  2. To replace the need for HTTPS on websites
  3. To provide a universal password shared across websites
  4. To define a web API for public-key-based authentication using an authenticator

Answer: D) To define a web API for public-key-based authentication using an authenticator

Explanation:

Web Authentication (WebAuthn) is a web standard that allows websites and applications to register and authenticate public-key credentials through supported authenticators. It is a core component of the FIDO2 ecosystem.

7. Which organization developed the FIDO standards in collaboration with industry participants?

  1. FIDO Alliance
  2. Internet Assigned Numbers Authority (IANA) alone
  3. World Wide Web Consortium's HTML Working Group alone
  4. International Telecommunication Union (ITU) alone

Answer: A) FIDO Alliance

Explanation:

The FIDO Alliance develops specifications and certification programs for authentication technologies designed to reduce reliance on passwords. Its work includes standards such as FIDO2 and related passkey technologies, developed with contributions from industry and standards organizations.

8. What is the purpose of local biometric verification during passkey authentication?

  1. To send the user's fingerprint to every website
  2. To replace the server's public key
  3. To verify the user's presence or authorization to use the authenticator
  4. To automatically grant administrator permissions

Answer: C) To verify the user's presence or authorization to use the authenticator

Explanation:

A device may use a fingerprint, facial recognition, or another local verification method before allowing a passkey to be used. The biometric information generally remains within the authenticator's protected environment rather than being sent to the website as the authentication credential.

9. Which authentication factor category does a hardware security key generally represent?

  1. Something the user knows
  2. Something the user possesses
  3. Something the user is
  4. Something the user remembers about a website

Answer: B) Something the user possesses

Explanation:

A hardware security key is a possession factor because the user must have access to the physical device. Depending on the implementation, the key may also require a PIN or biometric verification to authorize credential use.

10. Why is passkey authentication generally resistant to traditional phishing attacks?

  1. It sends the user's password to every website
  2. It disables all browser security mechanisms
  3. It relies only on the website's visual appearance
  4. Its cryptographic credentials are associated with the legitimate relying party

Answer: D) Its cryptographic credentials are associated with the legitimate relying party

Explanation:

WebAuthn credentials are scoped to a relying party, including its web origin. A fake website generally cannot obtain a valid authentication response for the legitimate website using that website's credential, which helps protect against credential-harvesting phishing.

11. What is a relying party in WebAuthn?

  1. The website or service that requests registration or authentication using a credential
  2. The person who manufactures a laptop
  3. The network router that assigns IP addresses
  4. The biometric sensor inside every mobile device

Answer: A) The website or service that requests registration or authentication using a credential

Explanation:

The relying party is the service that registers public-key credentials and later verifies authentication responses. It validates relevant details, such as the challenge, origin, and credential signature, according to the protocol requirements.

12. What is the primary purpose of an authentication challenge in a passkey protocol?

  1. To provide a permanent password for all future logins
  2. To expose the private key to the server
  3. To provide fresh data that the authenticator can sign or respond to cryptographically
  4. To eliminate the need for credential verification

Answer: C) To provide fresh data that the authenticator can sign or respond to cryptographically

Explanation:

A server-generated challenge helps establish that an authentication response corresponds to a current request. The server must validate the challenge and other protocol data to prevent replay and related attacks.

13. What is a major advantage of using a hardware security key instead of a password?

  1. It can be shared publicly without risk
  2. It can provide cryptographic authentication without transmitting a reusable password
  3. It removes the need to protect the user's account
  4. It guarantees that the user's computer cannot contain malware

Answer: B) It can provide cryptographic authentication without transmitting a reusable password

Explanation:

A security key can authenticate using a private key while the service verifies the response with a public key. This avoids sending a reusable password and, when used with a phishing-resistant protocol, helps protect against credential theft.

14. Which statement about biometric authentication is correct?

  1. Biometrics always provide perfect accuracy
  2. Biometric data must be published for authentication to work
  3. Biometric verification automatically authorizes every requested action
  4. Biometrics can verify a user's characteristic, but systems still require secure implementation and recovery controls

Answer: D) Biometrics can verify a user's characteristic, but systems still require secure implementation and recovery controls

Explanation:

Biometrics can support local user verification, but they are not infallible and may have false acceptance or rejection rates. Secure storage, presentation-attack defenses, privacy safeguards, and recovery procedures remain important.

15. What does device-bound passkey mean?

  1. The credential is associated with a particular authenticator or device and is not automatically synchronized as a passkey across devices
  2. The credential is publicly accessible from every computer
  3. The passkey is stored as a plain-text password on a web server
  4. The user can authenticate without any registered credential

Answer: A) The credential is associated with a particular authenticator or device and is not automatically synchronized as a passkey across devices

Explanation:

A device-bound credential remains associated with a specific authenticator rather than being synchronized through a passkey provider. This can suit high-security environments, although organizations must plan secure replacement and recovery when a device is lost.

16. What is a synced passkey?

  1. A password copied into an unprotected text file
  2. A credential that can be used only on one physical keyboard
  3. A passkey that can be securely synchronized across supported devices through a credential provider
  4. A security code that never changes and is shared by all users

Answer: C) A passkey that can be securely synchronized across supported devices through a credential provider

Explanation:

Synced passkeys can be available on multiple supported devices through a credential manager or ecosystem account. Synchronization improves convenience and recovery options, but the provider account and device ecosystem must also be protected.

17. What is the purpose of a fallback authentication method?

  1. To disable the primary authentication method permanently
  2. To provide an alternative way to access an account when the primary method is unavailable
  3. To give anonymous visitors administrative access
  4. To publish a user's private key

Answer: B) To provide an alternative way to access an account when the primary method is unavailable

Explanation:

Fallback methods support account recovery when a device is lost or a credential cannot be used. They must be secured carefully because attackers may target weaker recovery methods to bypass strong primary authentication.

18. Why should account recovery be designed carefully for passwordless authentication?

  1. Recovery should allow anyone to reset any account
  2. Recovery eliminates the need to protect registered credentials
  3. Recovery methods must always be less secure than passwords
  4. A weak recovery process can let attackers bypass strong passwordless authentication

Answer: D) A weak recovery process can let attackers bypass strong passwordless authentication

Explanation:

Even if the primary sign-in method is phishing-resistant, attackers may target email accounts, help-desk procedures, or recovery codes. Recovery must verify identity securely and should be monitored for suspicious activity.

19. Which protocol feature helps bind WebAuthn credentials to the intended website?

  1. Relying party ID and origin validation
  2. Reusing one credential across unrelated domains without restrictions
  3. Disabling challenge validation
  4. Sending the private key in an HTTP request

Answer: A) Relying party ID and origin validation

Explanation:

WebAuthn uses relying party information and origin-related checks to bind operations to the legitimate web context. Correct server-side validation helps prevent a malicious site from impersonating the intended relying party.

20. What is the primary difference between authentication and authorization?

  1. Authentication always happens after authorization
  2. Authorization verifies a biometric characteristic, while authentication assigns permissions
  3. Authentication verifies identity, while authorization determines permitted actions
  4. There is no difference between the two concepts

Answer: C) Authentication verifies identity, while authorization determines permitted actions

Explanation:

Passwordless authentication verifies that a user controls a registered credential or successfully completes an approved verification process. Authorization separately determines which resources and actions the authenticated identity may access.

21. Which option is an example of passwordless authentication using an email-based mechanism?

  1. Entering a traditional password twice
  2. Using a magic sign-in link delivered to a registered email address
  3. Sharing a permanent administrator password
  4. Disabling all account verification

Answer: B) Using a magic sign-in link delivered to a registered email address

Explanation:

A magic link can let a user authenticate by opening a time-limited link sent to a registered email address. Its security depends on the protection of the email account, the link's expiration and single-use behavior, and safeguards against interception or misuse.

22. What is an important security limitation of SMS-based one-time passcodes?

  1. They always require a hardware security key
  2. They are based on public-key signatures tied to a website origin
  3. They cannot be intercepted under any circumstances
  4. They can be vulnerable to SIM swapping, interception, and phishing

Answer: D) They can be vulnerable to SIM swapping, interception, and phishing

Explanation:

SMS codes can be exposed through phone-number takeover, interception, or real-time phishing. Although they may be used in some authentication workflows, phishing-resistant passkeys or security keys generally offer stronger protection against these attacks.

23. What does user verification mean in WebAuthn?

  1. The authenticator verifies the user through an approved method, such as a PIN or biometric, when required by the request
  2. The website checks only the user's screen resolution
  3. The server receives the user's fingerprint image in every login
  4. The browser automatically grants administrator access

Answer: A) The authenticator verifies the user through an approved method, such as a PIN or biometric, when required by the request

Explanation:

User verification is an authenticator operation that can involve a PIN, biometric check, or another supported mechanism. WebAuthn distinguishes user verification from user presence, and the relying party can specify whether verification is required.

24. What does user presence indicate in a WebAuthn authentication flow?

  1. The user has administrator privileges on the server
  2. The user has entered a traditional password
  3. The authenticator has detected an interaction indicating that a user is present
  4. The user's biometric template has been uploaded to the website

Answer: C) The authenticator has detected an interaction indicating that a user is present

Explanation:

User presence indicates that the authenticator detected an interaction, such as a touch or confirmation. It is distinct from user verification, which checks that the person is authorized to use the authenticator.

25. Which method is generally considered phishing-resistant when implemented correctly?

  1. A password sent through an unencrypted email
  2. A FIDO2 security key using origin-bound authentication
  3. A reusable security question
  4. A one-time code entered into any website that requests it

Answer: B) A FIDO2 security key using origin-bound authentication

Explanation:

FIDO2 security keys use public-key cryptography and bind authentication to the relying party. This prevents an ordinary phishing site from successfully using the credential to authenticate to the legitimate website.

26. What is a major benefit of passwordless authentication for organizations?

  1. It removes the need for all identity governance
  2. It guarantees that users will never lose access
  3. It makes access policies unnecessary
  4. It can reduce password-reset workload and exposure to password-related attacks

Answer: D) It can reduce password-reset workload and exposure to password-related attacks

Explanation:

Removing traditional passwords can reduce password reuse, credential stuffing, and some phishing risks. Organizations must still manage credential registration, device security, authorization, monitoring, and account recovery.

27. What is credential registration in a passkey system?

  1. Creating and associating a public-key credential with a user account
  2. Sending the private key to every website
  3. Publishing a user's biometric information
  4. Disabling all existing authentication methods without verification

Answer: A) Creating and associating a public-key credential with a user account

Explanation:

During registration, an authenticator creates a credential and the relying party stores the public key and related credential information. Secure enrollment is important because an attacker who can register their own credential on a victim's account may gain future access.

28. Why should an organization verify a user's identity before enrolling a new passkey for an existing account?

  1. To allow anyone to add credentials without permission
  2. To avoid maintaining account ownership records
  3. To prevent an unauthorized person from registering a credential and taking over the account
  4. To make every passkey publicly accessible

Answer: C) To prevent an unauthorized person from registering a credential and taking over the account

Explanation:

Credential enrollment changes how an account can be accessed. Requiring appropriate authentication and risk checks before adding a new credential helps prevent attackers from registering their own passkeys on compromised accounts.

29. Which statement about a passkey's private key is correct?

  1. It must be transmitted to the website during every login
  2. It is used by the authenticator to generate a cryptographic authentication response and should remain protected
  3. It is identical for every user of the service
  4. It is the same as the user's public username

Answer: B) It is used by the authenticator to generate a cryptographic authentication response and should remain protected

Explanation:

The private key is the secret part of a credential and is used to prove control of that credential. A properly designed public-key authentication flow does not send the private key to the relying party.

30. What is the purpose of a relying party's challenge expiration or freshness checks?

  1. To make the same authentication response valid forever
  2. To eliminate the need for a public key
  3. To allow a different website to reuse the challenge without validation
  4. To ensure that an authentication response corresponds to a valid, current authentication attempt

Answer: D) To ensure that an authentication response corresponds to a valid, current authentication attempt

Explanation:

Challenges should be unpredictable, tied to the relevant request, and validated correctly. Freshness and one-time-use checks help prevent replay of previously captured authentication responses.

31. Which statement about passwordless authentication and multifactor authentication (MFA) is correct?

  1. Passwordless authentication is a login approach, while MFA requires factors from at least two distinct categories
  2. Every passwordless method automatically satisfies every MFA requirement
  3. MFA can only use passwords
  4. Passwordless authentication always means biometric authentication

Answer: A) Passwordless authentication is a login approach, while MFA requires factors from at least two distinct categories

Explanation:

Passwordless describes authentication without a traditional password, whereas MFA describes the use of multiple authentication factor categories. Some passwordless methods can satisfy MFA requirements through possession and local user verification, but the result depends on the specific implementation and policy.

32. Why is a PIN used with some hardware security keys or passkeys?

  1. To replace the credential's public key with a password stored on the website
  2. To give the user unrestricted access to every application
  3. To authorize credential use or locally verify the user, depending on the authenticator
  4. To make the private key public

Answer: C) To authorize credential use or locally verify the user, depending on the authenticator

Explanation:

A PIN may be used locally by an authenticator to authorize use of a credential or verify the user. In a properly designed WebAuthn flow, the PIN is not sent to the relying party as a traditional login password.

33. What should a user do if a registered hardware security key is lost?

  1. Publish the remaining account recovery codes online
  2. Use an approved recovery process, revoke the lost credential where possible, and register a replacement
  3. Disable all security monitoring
  4. Share their account with another person

Answer: B) Use an approved recovery process, revoke the lost credential where possible, and register a replacement

Explanation:

Lost authenticators should be handled through a secure recovery process. Where supported, the user or administrator should remove the lost credential from the account, assess potential exposure, and register a new credential.

34. Which security risk can arise when a user relies on an email account to recover a passwordless account?

  1. Email-based recovery always provides phishing resistance
  2. Email recovery makes identity verification unnecessary
  3. Email accounts cannot be compromised
  4. An attacker who compromises the email account may be able to take over the target account through recovery

Answer: D) An attacker who compromises the email account may be able to take over the target account through recovery

Explanation:

Email can be a recovery channel, but a compromised mailbox may expose recovery links or messages. Organizations should assess the risk of recovery channels and protect them with strong authentication and suitable verification procedures.

35. What is the role of the authenticator in passwordless authentication?

  1. To create or use credentials and respond to authentication requests
  2. To grant all users the same permissions automatically
  3. To store every website's private key on a public server
  4. To replace all authorization decisions

Answer: A) To create or use credentials and respond to authentication requests

Explanation:

An authenticator may be a platform component, such as a device's built-in security hardware, or an external security key. It creates or uses credentials and responds to protocol requests under the relevant security controls.

36. Why is HTTPS important for passwordless authentication on the web?

  1. It automatically grants access to every registered account
  2. It makes the relying party's private key public
  3. It protects communication between the browser and website and supports trustworthy origin-based security
  4. It removes the need to validate authentication responses

Answer: C) It protects communication between the browser and website and supports trustworthy origin-based security

Explanation:

HTTPS provides transport encryption and server authentication for web communication. WebAuthn also relies on secure-context and origin-related protections, so proper HTTPS deployment is important for protecting the authentication flow.

37. Which practice best protects a passwordless account against unauthorized credential enrollment?

  1. Allowing credential enrollment without any sign-in verification
  2. Requiring strong reauthentication or another appropriate verification step before adding a credential
  3. Publishing a list of all registered credentials publicly
  4. Disabling alerts for account security changes

Answer: B) Requiring strong reauthentication or another appropriate verification step before adding a credential

Explanation:

Adding a passkey or security key changes the set of authenticators that can access an account. Strong verification, user notifications, and audit records can help prevent unauthorized credential enrollment and persistence by attackers.

38. What is one advantage of using passwordless authentication with enterprise Single Sign-On (SSO)?

  1. It makes authorization policies unnecessary across applications
  2. It requires users to share one private key with all coworkers
  3. It disables identity provider security controls
  4. It can simplify sign-in while strengthening the initial authentication to the identity provider

Answer: D) It can simplify sign-in while strengthening the initial authentication to the identity provider

Explanation:

Passwordless authentication can strengthen sign-in to an enterprise identity provider, while SSO can extend that authenticated session to connected applications. Each application must still enforce appropriate authorization and session controls.

39. What is a passkey credential ID used for?

  1. To identify a registered credential during authentication
  2. To reveal the private key to the server
  3. To replace all account authorization policies
  4. To store a user's biometric template as a public value

Answer: A) To identify a registered credential during authentication

Explanation:

A credential ID helps the relying party identify a registered credential. It is distinct from the private key and is used as part of the credential management and authentication process.

40. Which action is most appropriate when an organization suspects that a user's passwordless device has been compromised?

  1. Ignore the alert because no password is used
  2. Grant the device additional administrator privileges
  3. Assess the incident, revoke affected credentials or sessions where appropriate, and secure account recovery
  4. Publish the user's authentication logs publicly

Answer: C) Assess the incident, revoke affected credentials or sessions where appropriate, and secure account recovery

Explanation:

Passwordless authentication reduces certain password-related risks but does not eliminate device compromise or account takeover. Incident response should assess the credential and device, revoke affected access when appropriate, and ensure the account is recovered securely.

41. What is the main difference between a one-time password (OTP) and a passkey?

  1. OTP always uses a public-private key pair
  2. An OTP is a temporary code, while a passkey uses a public-key credential for cryptographic authentication
  3. A passkey is always a six-digit number
  4. Both methods always provide the same phishing resistance

Answer: B) An OTP is a temporary code, while a passkey uses a public-key credential for cryptographic authentication

Explanation:

An OTP is a code that is valid under a defined time or usage condition and may be entered into a phishing site. A passkey uses a cryptographic credential associated with the relying party, providing stronger resistance to conventional credential-harvesting phishing.

42. Which consideration is especially important when deploying passwordless authentication across a large organization?

  1. Allowing all users to bypass enrollment controls
  2. Removing all support procedures
  3. Using a single shared authenticator for the entire organization
  4. Planning enrollment, device compatibility, recovery, user support, and policy enforcement

Answer: D) Planning enrollment, device compatibility, recovery, user support, and policy enforcement

Explanation:

Enterprise deployment requires more than enabling a sign-in feature. Organizations must plan supported devices, credential enrollment, account recovery, lost-device procedures, administrative controls, and monitoring to ensure the solution remains secure and usable.

43. Why should authentication events for passwordless accounts be monitored?

  1. To detect unusual sign-ins, credential changes, and suspicious recovery activity
  2. To guarantee that attacks are impossible
  3. To eliminate the need for authorization
  4. To expose private keys in audit records

Answer: A) To detect unusual sign-ins, credential changes, and suspicious recovery activity

Explanation:

Monitoring helps identify suspicious behavior such as unexpected credential registration, repeated failed authentication attempts, unusual sign-ins, or recovery changes. Logs should avoid storing private keys and other unnecessary sensitive authentication material.

44. What is an important security consideration when using a QR code to authenticate through a nearby device?

  1. QR codes automatically prove the identity of every person who scans them
  2. The user should share the QR code publicly to simplify access
  3. The flow should protect against relay abuse and verify the intended sign-in context
  4. QR-based authentication never requires cryptographic protection

Answer: C) The flow should protect against relay abuse and verify the intended sign-in context

Explanation:

Some cross-device authentication flows use a QR code to initiate a secure interaction between devices. The implementation should use the protocol's security checks and user confirmation to reduce risks such as unauthorized relaying or signing in to the wrong session.

45. Which statement best describes passwordless authentication and Zero Trust security?

  1. Passwordless authentication automatically makes every application trustworthy
  2. Passwordless authentication can strengthen identity verification, but Zero Trust still requires access policies and ongoing risk evaluation
  3. Zero Trust requires all users to share one passkey
  4. Passwordless authentication eliminates device security requirements

Answer: B) Passwordless authentication can strengthen identity verification, but Zero Trust still requires access policies and ongoing risk evaluation

Explanation:

Passwordless methods can improve authentication, especially when they are phishing-resistant. Zero Trust also considers authorization, device posture, resource sensitivity, and context rather than treating successful sign-in as unrestricted access.

46. What is the primary purpose of credential revocation in a passwordless system?

  1. To make the credential usable by every website
  2. To reveal the credential's private key
  3. To eliminate all account security records
  4. To prevent a compromised, lost, or no-longer-authorized credential from being accepted

Answer: D) To prevent a compromised, lost, or no-longer-authorized credential from being accepted

Explanation:

Credential revocation removes or disables a credential's ability to authenticate to the account. It is an important response to lost devices, suspected compromise, employee departures, and other changes in access authorization.

47. Which statement about passwordless authentication and privacy is correct?

  1. Biometric information must always be uploaded to every relying party
  2. Public keys reveal the corresponding private keys automatically
  3. Well-designed systems can perform biometric verification locally without sending the biometric itself to the service
  4. Passwordless authentication makes all user activity anonymous

Answer: C) Well-designed systems can perform biometric verification locally without sending the biometric itself to the service

Explanation:

With many platform authenticators, biometric verification occurs locally and authorizes the use of a cryptographic credential. The relying party receives the authentication response rather than the user's raw biometric data, although privacy properties depend on the implementation.

48. What should an organization do before enforcing passwordless authentication for all employees?

  1. Pilot the solution, test supported workflows and recovery, and establish a controlled rollout plan
  2. Disable all employee accounts without warning
  3. Publish recovery codes in a shared document
  4. Remove monitoring from the identity provider

Answer: A) Pilot the solution, test supported workflows and recovery, and establish a controlled rollout plan

Explanation:

A pilot helps identify compatibility issues, enrollment difficulties, accessibility needs, and recovery weaknesses before a broad rollout. A phased deployment with clear support procedures reduces disruption while allowing security teams to validate the controls.

49. A user successfully authenticates with a passkey, but the application denies access to a confidential report because the user lacks the required permission. Is this expected behavior?

  1. No, because a passkey grants access to every resource
  2. Yes, because authentication verifies identity while authorization determines access permissions
  3. No, because passkeys bypass application security policies
  4. Yes, but only if the user enters a password afterward

Answer: B) Yes, because authentication verifies identity while authorization determines access permissions

Explanation:

Successful passkey authentication establishes that the user controls a registered credential under the relevant protocol. The application must still evaluate permissions and resource-specific policies before allowing access to confidential information.

50. A company deploys passkeys for its employees. An attacker creates a fake login website and sends employees a link asking them to sign in. An employee opens the fake site, but the browser will not use the company's registered passkey for that site. Which security property best explains this result?

  1. The passkey is a password that changes every minute
  2. The fake site automatically receives the employee's private key
  3. The passkey grants access only when a user enters a shared company password
  4. The passkey's cryptographic authentication is bound to the legitimate relying party and origin

Answer: D) The passkey's cryptographic authentication is bound to the legitimate relying party and origin

Explanation:

WebAuthn passkeys are associated with the relying party, and the browser and authenticator enforce origin-related protections. A lookalike phishing site cannot normally use the legitimate site's registered credential to produce a valid authentication response. This phishing resistance depends on correct implementation and does not eliminate every account-takeover risk, including compromised recovery channels or devices.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.