A city VPN admin team must approve a phone prompt in addition to entering a password before connecting to municipal systems. Which authentication concept does that requirement describe?
Select an answer to reveal the explanation.
Short Explanation
Think of MFA like needing both a keycard and a PIN to open the server room door. A password alone is one factor; the phone approve adds another. That combo is what MFA is for.
Full Explanation
Multifactor authentication (MFA) requires two or more independent authentication factors before access is granted—commonly something the user knows (a password) combined with something they have (a phone authenticator prompt or hardware key) or something they are (biometrics). For the municipal VPN admin team, requiring a phone approval after the password raises assurance that a stolen or shared password alone cannot open the remote connection path into city systems. That layered proof is the defining purpose of MFA at Azure Fundamentals depth and maps directly to how Microsoft Entra ID strengthens sign-in for privileged and remote access scenarios.
Single sign-on addresses session convenience across many applications after identity is established; it does not by itself add a second authentication factor at each critical gate. A public storage account removes authentication for anonymous object access and therefore cannot stand in for stronger admin VPN sign-in. Azure Arc extends Azure management and governance patterns to non-Azure and on-premises resources; it does not redefine password-only authentication as multifactor proof.
Exam caveat: MFA and SSO often appear together in real tenants, but they solve different problems—assurance versus reduced password re-entry—so treat them as complementary, not interchangeable, on AZ-900 items.
Operational check: in Microsoft Entra ID, confirm MFA registration status for the VPN admin group, verify the Conditional Access or per-user MFA policy that requires the extra factor for that app or location, and test a password-only attempt to prove the second factor is actually enforced before production cutover.